Repository navigation
ci: add reusable Trivy image scan - #6
Merged
Merged
Conversation
Scans the caller's published latest and slim images with Trivy, uploads SARIF to code scanning and writes the same results as a table to the run summary, since code scanning alerts need write access to view. Report only; never fails the run. trivy-action and upload-sarif are pinned by commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
scan-image.yml, a reusable workflow that scans an image repo's published images with Trivy. Prompted by CaddyBuilds/caddy-cloudflare#43, where a user has been running these scans by hand.latest, plusslimwhencaddy-image.jsonenables it, on linux/amd64.trivy-action(v0.36.0) andupload-sarif(v4.39.1) are pinned by commit, since trivy-action's release tags were hijacked in March 2026. Trivy itself is pinned to v0.76.1.GITHUB_REPOSITORY, and GHCR credentials fromGITHUB_TOKENcover private packages.Also adds
examples/.github/workflows/scan-images.yml(daily at 06:00 UTC, after each successful build, and manual) and documents both in the README.Tested locally with Trivy 0.76.1 against
ghcr.io/caddybuilds/caddy-cloudflare:slim. The JSON → SARIF → table conversions work, and they report the same 11 findings as #43. actionlint passes; its only warnings are thejob.workflow_shaones the existing workflows also get.