trivy.yml

name: Scan Docker images

on:
  schedule:
    - cron: '22 15 * * *'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.actor }}/inga

jobs:
  build-and-scan-image:

    runs-on: ubuntu-latest
    strategy:
      matrix:
        target: [typescript, java]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
        with:
          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest-${{ matrix.target }}'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'