docker-security.yml

name: Trivy Image Scan

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

jobs:
  scan:
    name: Scan Docker Image with Trivy
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image
        run: docker build -t python-samples-fastapi-restful .

      - name: Install Trivy manually
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

      - name: Run Trivy scan 
        run: |
          trivy image --no-progress --format table -o trivy-report.txt python-samples-fastapi-restful

      - name: Upload Trivy report
        uses: actions/upload-artifact@v4
        with:
          name: trivy-scan-report
          path: trivy-report.txt