Trivy Vulnerability Scan #191

	name: Trivy Vulnerability Scan

	on:
	push:
	branches:
	- main
	schedule:
	- cron: '0 0 * * *' # Runs every day at midnight

	permissions:
	contents: read

	jobs:
	scan:
	permissions:
	contents: write # for Git to git push
	runs-on: ubuntu-latest

	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
	with:
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

	- name: Install Trivy
	run: \|
	sudo apt-get update
	sudo apt-get install -y wget
	wget https://github.com/aquasecurity/trivy/releases/download/v0.53.0/trivy_0.53.0_Linux-64bit.deb
	sudo dpkg -i trivy_0.53.0_Linux-64bit.deb

	- name: Pull latest docker images
	run: \|
	docker pull clecap/dante-wiki:latest

	- name: Run Trivy scan
	run: \|
	mkdir -p .github/results
	trivy image clecap/dante-wiki:latest > .github/results/trivy-scan-dante-wiki.txt

	- name: Commit and push vulnerability report
	run: \|
	git config --global user.name 'github-actions[bot]'
	git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
	git add .github/results/trivy-scan-dante-wiki.txt
	git commit -m 'Update trivy vulnerability report'
	git push
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback