trivy-test-images.yml

name: Trivy Docker Image Analysis

on:
  push:
  # Trigger manually
  workflow_dispatch:

permissions:
  security-events: write # To upload sarif files

jobs:
  build-and-scan-frontend:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Helm
        uses: azure/setup-helm@v3
        with:
          version: '3.6.3'

      - name: Set up python
        uses: actions/setup-python@v5
        with:
          python-version: '3.7'

      # Workaround: https://github.com/docker/build-push-action/issues/461
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
        with:
          context: .
          file: ./frontend/Dockerfile
          push: false
          tags: frontend:latest
          load: true  # Load the image into Docker's local image store


      - name: Run Trivy Table
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'image'
          image-ref: 'frontend:latest'
          severity: 'MEDIUM,HIGH,CRITICAL'
          format: 'table'

  build-and-scan-backend:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: '3.6.3'

      - name: Set up python
        uses: actions/setup-python@v5
        with:
          python-version: '3.7'

      # Workaround: https://github.com/docker/build-push-action/issues/461
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0
        with:
          context: .
          file: ./backend/Dockerfile
          push: false
          tags: backend:latest
          load: true  # Load the image into Docker's local image store


      - name: Run Trivy Table
        uses: aquasecurity/trivy-action@0.19.0
        with:
          scan-type: 'image'
          image-ref: 'backend:latest'
          severity: 'MEDIUM,HIGH,CRITICAL'
          format: 'table'