scan

scan #6

	name: scan

	on:
	workflow_run:
	workflows: [docker_publish]
	types: [completed]

	# Allows you to run this workflow manually from the Actions tab
	workflow_dispatch:

	env:
	IMAGE_NAME: sillytavern

	# Sets the permissions granted to the GITHUB_TOKEN for the actions in this job.
	permissions:
	security-events: write

	jobs:
	scan:
	name: Scan Docker image
	runs-on: ubuntu-latest
	if: ${{ github.event.workflow_run.conclusion == 'success' \|\| github.event_name == 'workflow_dispatch' }}
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	sparse-checkout: \|
	.github/workflows/scan/html.tpl
	sparse-checkout-cone-mode: false

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/[email protected]
	with:
	image-ref: "ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest"
	vuln-type: "os,library"
	scanners: vuln
	severity: "CRITICAL,HIGH"
	format: "template"
	template: "@.github/workflows/scan/html.tpl"
	ignore-unfixed: true
	output: "trivy-results.html"

	- name: Upload Artifact
	uses: actions/upload-artifact@v4
	with:
	name: trivy-results
	path: trivy-results.html
	retention-days: 90

	- name: Run Trivy vulnerability scanner (SARIF)
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest"
	vuln-type: "os,library"
	scanners: vuln
	severity: "CRITICAL,HIGH"
	format: "sarif"
	ignore-unfixed: true
	output: "trivy-results.sarif"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-results.sarif"

Provide feedback