trivy-scan.yml

name: Trivy Vulnerability Scan (Repo mode)

on:
  workflow_dispatch:

jobs:
  run_trivy_scan:
    name: Run Trivy Scan
    runs-on: ubuntu-latest
    steps:
    
      - uses: actions/checkout@v3
      - uses: spring-io/spring-gradle-build-action@v2
      - name: Build
        run: |
          ./gradlew clean build -x integrationTest -x test
          curdir=$(pwd)
          mkdir $curdir/maven-repo-local
          ./gradlew --info -Dmaven.repo.local=$curdir/maven-repo-local pTML
          
      - name: Run Trivy scan in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: './maven-repo-local/org/springframework/pulsar'
          trivy-config: trivy.yaml
          format: 'json'
          output: 'trivy-results.json'
          severity: 'CRITICAL'
          
      - name: Output Trivy scan results
        if: always()
        run: |
          cat trivy-results.json
    
      - name: Upload Trivy scan results
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: trivy-results
          path: trivy-results.json
          retention-days: 3