mirror of
https://github.com/wimpysworld/stream-sprout
synced 2026-03-23 02:24:39 +01:00
9de404f4b2* feat: generate container sbom during release * No need to publish separately, it's automatic * feat: Add regular vulnerability scanning * syntax * specify container file * vital missing step * Display grype output in the log in table format
35 lines
No EOL
818 B
YAML
35 lines
No EOL
818 B
YAML
name: "Vulnerability 🐞 scan 🔍 container"
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 10 * * 2"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
vulnerability-scan:
|
|
name: "Build and scan"
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v2
|
|
|
|
- name: build local container
|
|
uses: docker/build-push-action@v4
|
|
with:
|
|
context: .
|
|
file: ./Containerfile
|
|
tags: localbuild/testimage:latest
|
|
push: false
|
|
load: true
|
|
|
|
- name: Scan image
|
|
uses: anchore/scan-action@v3
|
|
with:
|
|
image: "localbuild/testimage:latest"
|
|
output-format: table
|
|
|
|
- name: Inspect action report
|
|
run: cat ${{ steps.scan.outputs.table }} |