diff options
| author | Alexandre FLAMENT <alexandre.flament@hesge.ch> | 2022-08-31 18:38:59 +0000 |
|---|---|---|
| committer | Alexandre FLAMENT <alexandre.flament@hesge.ch> | 2022-08-31 18:38:59 +0000 |
| commit | 1f78445d884bf2c07ff47f2425c9f26017541c09 (patch) | |
| tree | bc7374a48dfc6db9265a57f01be5497776514d9b /.github | |
| parent | 8a56e3d443d12c1b5f467bdffcb746747a7107ef (diff) | |
| download | searxng-1f78445d884bf2c07ff47f2425c9f26017541c09.tar.gz searxng-1f78445d884bf2c07ff47f2425c9f26017541c09.zip | |
GitHub worfklow: add daily security check using trivy
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/security.yml | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 000000000..d9503af11 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,28 @@ +name: "Security checks" +on: + schedule: + - cron: "42 05 * * *" + workflow_dispatch: + +jobs: + dockers: + name: Trivy ${{ matrix.image }} + runs-on: ubuntu-20.04 + steps: + - name: Checkout + uses: actions/checkout@v2 + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: 'searxng/searxng:latest' + ignore-unfixed: false + vuln-type: 'os,library' + severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' + format: 'sarif' + output: 'trivy-results.sarif' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results.sarif' |