Skip to content

Merge pull request #2793 from Permify/ufuk/configurable-grpc-host #983

Merge pull request #2793 from Permify/ufuk/configurable-grpc-host

Merge pull request #2793 from Permify/ufuk/configurable-grpc-host #983

name: Container Security Scan
on:
push:
branches:
- master
pull_request:
branches:
- master
permissions:
contents: read
jobs:
container-security-scan:
name: Scan Container for Vulnerabilities
runs-on: ubuntu-24.04
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- name: Build Docker image for scanning
run: |
docker build -t ghcr.io/permify/permify:scan-${{ github.sha }} .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
with:
image-ref: 'ghcr.io/permify/permify:scan-${{ github.sha }}'
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'