Scheduled docker container scan #139

	name: Scheduled docker container scan

	on:
	schedule:
	- cron: "0 21 * * 1-5"
	workflow_dispatch:

	env:
	ZAC_IMAGE_URL: 'ghcr.io/infonl/zaakafhandelcomponent:latest'

	permissions:
	security-events: write

	jobs:
	build:
	name: Run docker scan
	runs-on: ubuntu-22.04
	steps:
	- name: Pull Docker Image
	run: docker pull ${{ env.ZAC_IMAGE_URL }}

	- name: Run Trivy Vulnerability Scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: ${{ env.ZAC_IMAGE_URL }}
	format: 'sarif'
	output: 'trivy-results.sarif'
	# limit the severities even when using Sarif
	# or else all vulnerabilities will be reported
	limit-severities-for-sarif: true
	severity: 'CRITICAL,HIGH'

	- name: Upload Trivy Scan Results to GitHub Security Tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'trivy-results.sarif'

	- name: Run Snyk to check Docker image for vulnerabilities
	continue-on-error: true
	uses: snyk/actions/docker@master
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	sarif: true
	image: ${{ env.ZAC_IMAGE_URL }}
	args: --severity-threshold=high --sarif --sarif-file-output=snyk.sarif

	- name: Upload Snyk Scan Results to GitHub Security Tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'snyk.sarif'

Provide feedback