security #129
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MIT | |
| # Copyright (c) 2026 Netresearch DTT GmbH | |
| # | |
| # CVE scanning for the published glpi-php-fpm image. | |
| # | |
| # Runs: | |
| # - Trivy container scan against :latest — delegated to the reusable | |
| # security-container.yml in netresearch/.github (HIGH/CRITICAL → SARIF, | |
| # exit-code 0 = informational). Trivy walks the whole image filesystem, | |
| # so it also enumerates GLPI's bundled PHP dependencies via | |
| # vendor/composer/installed.json — no separate lockfile job is needed. | |
| # | |
| # Note: the GLPI image is built FROM the upstream release tarball, which | |
| # ships vendor/ but NO root composer.lock — so (unlike a Composer-built | |
| # app) there is nothing extra to scan beyond what Trivy already covers. | |
| # There is also no `:rolling` deps line; the floating tags are rebuilt | |
| # daily to pick up base-image CVEs. | |
| # | |
| # Scope is intentionally limited to vulnerability scanning. Scorecard, | |
| # cosign signing/verification, and SBOM attestation live in separate | |
| # workflows. | |
| name: security | |
| on: | |
| # Trigger AFTER a successful build (build workflow pushed fresh images | |
| # to ghcr.io). Running on `push` would race the build and try to scan | |
| # a tag that doesn't exist yet. | |
| workflow_run: | |
| workflows: [build] | |
| types: [completed] | |
| branches: [main] | |
| schedule: | |
| # Daily at 06:00 UTC — picks up CVEs disclosed since the last build. | |
| - cron: '0 6 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: security-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| trivy: | |
| # On workflow_run, only run if the upstream build actually succeeded | |
| # (the build job pushed the fresh :latest image to ghcr.io). Running on | |
| # `push` would race the build and try to scan a tag that doesn't exist. | |
| if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }} | |
| name: trivy (latest) | |
| permissions: | |
| contents: read | |
| packages: read # pull from ghcr.io (private/org-locked packages) | |
| security-events: write # SARIF upload to GitHub code-scanning | |
| uses: netresearch/.github/.github/workflows/security-container.yml@main | |
| with: | |
| image-ref: ghcr.io/${{ github.repository_owner }}/glpi-php-fpm:latest | |
| sarif-category: trivy-latest |