run-trivy.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Run Aqua Security Trivy vulnerability scanner

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  trivy:
    name: Trivy
    runs-on: ubuntu-latest
    steps:
      # https://github.com/marketplace/actions/harden-runner
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      # https://github.com/marketplace/actions/checkout
      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # https://github.com/marketplace/actions/aqua-security-trivy
      - name: Run Trivy vulnerability scanner in IaC mode
        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
        with:
          scan-type: config
          hide-progress: false
          format: sarif
          output: trivy-results.sarif
          exit-code: "1"
          ignore-unfixed: true
          severity: CRITICAL,HIGH
          scan-ref: infra/terraform

      # Upload the results to GitHub's code scanning dashboard.
      # https://github.com/github/codeql-action
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
        with:
          sarif_file: trivy-results.sarif