image-vulnability.yml

name: Docker Image Vulnability Check
on:
  pull_request:
    branches: master
  push:
    branches:
      - '*'
jobs:
  build:
    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != 'wahyd4/aria2-ariang-docker'
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    - name: Build the Docker image
      run: docker build . --file Dockerfile --tag local/aria-ui:latest
    - name: Scan image
      uses: anchore/scan-action@v2
      with:
        image: "local/aria-ui:latest"
        fail-build: true
        severity-cutoff: high
    - name: grype scan JSON results
      run: for j in `ls ./anchore-reports/*.json`; do echo "---- ${j} ----"; cat ${j}; echo; done