clang-tools-docker/.github/workflows/docker-scout.yml at main · cpp-linter/clang-tools-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
name: Docker Scout

on:
  push:
    branches: [main]
    paths:
      - 'Dockerfile*'
      - '.github/workflows/docker-scout.yml'
  pull_request:
    branches: [main]
    paths:
      - 'Dockerfile*'
      - '.github/workflows/docker-scout.yml'

permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  scout:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Build image
        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          file: Dockerfile
          build-args: |
            BASE_IMAGE=ubuntu:questing
            CLANG_VERSION=21
          load: true
          tags: xianpengshen/clang-tools:21

      - name: Login to Docker Hub
        if: github.actor != 'dependabot[bot]'
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Docker Scout CVEs
        if: github.actor != 'dependabot[bot]'
        uses: docker/scout-action@7520205ff60037fdc436b40b6a1d1e55a839ec2d # v1.22.0
        with:
          command: cves
          image: xianpengshen/clang-tools:21
          sarif-file: scout.sarif
          only-severities: critical,high

      - name: Upload SARIF to GitHub Code Scanning
        if: github.actor != 'dependabot[bot]'
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.35.1
        with:
          sarif_file: scout.sarif