docker-bench-security.yaml

---
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

name: "[Code Analysis] Docker Bench Security"
run-name: "[Code Analysis] Docker Bench Security"

on:
  workflow_call: {}
  workflow_dispatch: {}
  push:
    branches:
      - main
      - release-*
  merge_group: {}

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  DOCKER_BUILDKIT: 1
  SUPASS: ${{ secrets.SUPASS }}

jobs:
  dbs-scan:
    name: "Docker Bench Security Scan"
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: "Checkout code"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #6.0.2
        with:
          path: scenescape
          persist-credentials: false
          fetch-depth: 0
      - name: "Checkout DBS"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #6.0.2
        with:
          repository: docker/docker-bench-security
          path: docker-bench-security
          persist-credentials: false

      - name: "Build Scenescape images"
        working-directory: scenescape
        run: |
          make
          make demo

      - name: "Run DBS scan"
        working-directory: docker-bench-security
        run: |
          sudo sh docker-bench-security.sh -l dbs_results