ci: add container vulnerability scan through trivy for Gateway pipeline

thoughtworks · Jul 6, 2023 · 2c64552 · 2c64552
1 parent 1870743
commit 2c64552
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
@@ -45,3 +45,12 @@ jobs:
           --build-arg TARGETARCH=amd64
       env:
         DOCKER_BUILDKIT: 1
+    - name: Run Trivy container vulnerability scan
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: '${{env.SERVICE}}:${GITHUB_SHA}'
+        format: 'table'
+        exit-code: '1'
+        ignore-unfixed: true
+        vuln-type: 'os,library'
+        severity: 'CRITICAL,HIGH'