Merge branch 'main' into dependabot/github_actions/docker/build-push-action-4

Author: tcarmet

.github/workflows/docker-build.yaml

@@ -60,15 +60,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         lfs: ${{ inputs.lfs }}
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v2
 
     - name: Login to ${{ inputs.registry }}
-      uses: docker/login-action@v1
+      uses: docker/login-action@v2
       with:
         registry: ${{ inputs.registry }}
         username: ${{ env.REGISTRY_LOGIN }}

.github/workflows/publish-docs.yaml

@@ -31,7 +31,7 @@ jobs:
       - run: pip install -r requirements.txt
       - run: mkdocs build --strict
       - name: Setup Pages
-        uses: actions/configure-pages@v1
+        uses: actions/configure-pages@v3
       - uses: actions/upload-pages-artifact@v1
         with:
           path: site/

.github/workflows/tests.yaml

@@ -1,5 +1,10 @@
 on: push
 
+permissions:
+  packages: write
+  contents: read
+  security-events: write
+
 jobs:
   docker-build:
     uses: ./.github/workflows/docker-build.yaml

docs/trivy.md

@@ -0,0 +1,14 @@
+# Trivy
+
+`trivy.yaml` is a GitHub Actions workflow that utilizes Trivy,
+an open-source vulnerability scanner for Docker containers and images.
+The action is triggered when a workflow is called with an image-ref input.
+It performs the following:
+
+* A scan of the specified Docker image with Trivy using the [trivy action](https://github.com/aquasecurity/trivy-action).
+* Upload the Trivy scan results in SARIF format to GitHub Security tab
+using the [upload-sarif](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github) action.
+
+This configuration file enables easy integration of vulnerability scanning
+for Docker images into a GitHub CI/CD pipeline. Results can be viewed in the
+GitHub Security tab for further analysis and vulnerability remediation.

mkdocs.yml

@@ -40,6 +40,7 @@ theme:
 nav:
 - Home: index.md
 - Docker build: docker-build.md
+- Trivy: trivy.md
 - Known issues: known-issues.md
 
 markdown_extensions: