trivy-zenserver.yml

---
name: Trivy ZenServer Scan
on:
  push:
    branches: [main]
  schedule:
    - cron: 0 4 * * 1  # At 04:00 on Monday
jobs:
  trivy-scan:
    name: Trivy ZenServer scan & analysis
    if: github.repository == 'zenml-io/zenml'
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4.1.1
      - name: zenserver-Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: docker.io/zenmldocker/zenml-server:latest
          format: sarif
          output: trivy-results-zenserver.sarif
          # Ignore unfixed vulnerabilities (i.e. vulnerabilities that have no
          # fix available and that we can't fix by updating the container
          # packages)
          ignore-unfixed: true
      - name: Upload Trivy zenserver scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results-zenserver.sarif