docker-security.yml

name: 🔍 Validate Docker Image with Trivy (docker-compose)

on:
  pull_request:
    branches: [master]
  push:
    branches: [master]

jobs:
  build-and-scan:
    runs-on: ubuntu-latest

    steps:
      - name: 🧾 Checkout repo
        uses: actions/checkout@v3

      - name: 🐳 Set up Docker Compose
        run: sudo apt-get update && sudo apt-get install -y docker-compose

      - name: 🛠️ Build image without cache
        run: docker compose build --no-cache

      - name: 🐳 List Docker images (debug)
        run: docker images

      - name: 🔍 Run Trivy via Docker (scan local image)
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            -v $HOME/.cache:/root/.cache/ \
            aquasec/trivy:latest \
            image --format table --exit-code 1 --ignore-unfixed \
            --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
            python-samples-fastapi-restful:latest