trivy.yml

name: Trivy Vulnerability Scan
on:
  pull_request:
    paths:
      - 'docker/**'
      - 'kubernetes/**'

permissions:
  contents: read
  security-events: write
  pull-requests: write
  issues: write

jobs:
  trivy-scan:
    runs-on: self-hosted
    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Fetch all history for git diff
        run: |
          if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
            git fetch --unshallow
          else
            git fetch --depth=2
          fi

      - name: Extract changed images from PR diff
        id: images
        run: |
          echo "=== Analyzing PR diff for container images ==="
          
          # Get all changed files in docker/ and kubernetes/
          changed_files=$(git diff --name-only HEAD~1 HEAD | grep -E '^(docker|kubernetes)/' || true)
          echo "Changed files: $changed_files"
          
          if [ -z "$changed_files" ]; then
            echo "No docker or kubernetes files changed"
            echo "should_scan=false" >> $GITHUB_OUTPUT
            exit 0
          fi
          
          # Look for changes to k8s images in the actual diff
          repo=$(git diff HEAD~1 HEAD | grep -E '^\+.*repository:' | sed -E 's/.*repository:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1)
          tag=$(git diff HEAD~1 HEAD | grep -E '^\+.*tag:' | sed -E 's/.*tag:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1)
          
          echo "Found k8s repo: '$repo', tag: '$tag'"

          if [ -n "$repo" ] && [ -n "$tag" ]; then
            image="$repo:$tag"
            echo "Using k8s format: $image"
          else
            # Fall back to plain image: lines (docker-compose)
            image=$(git diff HEAD~1 HEAD | grep -E '^\+.*image:' | sed -E 's/.*image:[[:space:]]*([^[:space:]#]+).*/\1/' | head -n1)
            echo "Raw image found: '$image'"
            
            # Clean up common prefixes and quotes
            image=$(echo "$image" | sed -E 's/^["\x27]//; s/["\x27]$//; s/^[[:space:]]*//; s/[[:space:]]*$//')
            echo "Cleaned image: '$image'"
          fi

          echo "Found image: $image"
          echo "image=$image" >> $GITHUB_OUTPUT
          
          # Set a flag to indicate if we should run the scan
          if [ -n "$image" ] && [ "$image" != "" ]; then
            echo "should_scan=true" >> $GITHUB_OUTPUT
            echo "Will scan image: $image"
          else
            echo "should_scan=false" >> $GITHUB_OUTPUT
            echo "No container images found in the diff, skipping Trivy scan"
          fi

      - name: Scan changed image with Trivy
        if: steps.images.outputs.should_scan == 'true'
        uses: aquasecurity/trivy-action@0.33.1
        with:
          image-ref: ${{ steps.images.outputs.image }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        if: steps.images.outputs.should_scan == 'true'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Comment PR with link to security scan
        if: steps.images.outputs.should_scan == 'true'
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const image = '${{ steps.images.outputs.image }}';
            const prNumber = context.issue.number;
            const scanUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/security/code-scanning?query=pr%3A${prNumber}+tool%3ATrivy+is%3Aopen`;
            
            const comment = "## 🛡️ Trivy Security Scan Complete\n\n" +
              `**Scanned Image:** \`${image}\`\n` +
              `📊 **[View Security Scan Results](${scanUrl})**\n\n` +
              "_Results are available in the Security tab above._";
            
            // Find existing comment to update
            const comments = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            
            const existingComment = comments.data.find(comment => 
              comment.body.includes('🛡️ Trivy Security Scan Complete')
            );
            
            if (existingComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingComment.id,
                body: comment
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body: comment
              });
            }