Trivy Container Vulnerability Scan #24

	---
	# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
	name: Trivy Container Vulnerability Scan

	on:
	workflow_run:
	workflows:
	- Release Multi-Architecture Image
	types:
	- completed
	schedule:
	- cron: '50 7 * * 5'
	workflow_dispatch:

	permissions:
	contents: read

	concurrency:
	group: trivy-scan-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	trivy:
	if: ${{ github.event_name != 'workflow_run' \|\| github.event.workflow_run.conclusion == 'success' }}
	name: Scan latest container image
	runs-on: ubuntu-24.04

	permissions:
	contents: read
	security-events: write

	env:
	TRIVY_CACHE_DIR: .trivycache

	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Cache Trivy DB
	uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
	with:
	path: .trivycache
	key: trivy-${{ runner.os }}-${{ hashFiles('**/Dockerfile') }}
	restore-keys: \|
	trivy-${{ runner.os }}-

	- name: Run Trivy image scan
	uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
	with:
	image-ref: ghcr.io/${{ github.repository }}:latest
	format: sarif
	output: trivy.sarif
	ignore-unfixed: true

	- name: Upload SARIF to code scanning
	uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
	with:
	sarif_file: trivy.sarif

Provide feedback