trivy.yml

---
name: Trivy Security Check
on:
  push:
    branches:
      - main
  pull_request:
permissions: read-all
jobs:
  trivy-check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # v0.35.0
        with:
          scan-type: "fs"
          ignore-unfixed: true
          exit-code: '1'
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@256d634097be96e792d6764f9edaefc4320557b1  # v4
        if: always()
        with:
          sarif_file: "trivy-results.sarif"