scheduled-container-scanning.yml

name: Scheduled docker container scan

on:
  schedule:
    - cron: "0 21 * * 1-5"
  workflow_dispatch:

env:
  ZAC_IMAGE_URL: 'ghcr.io/infonl/zaakafhandelcomponent:latest'

permissions:
  security-events: write

jobs:
  build:
    name: Run docker scan
    runs-on: ubuntu-22.04
    steps:
      - name: Pull Docker Image
        run: docker pull ${{ env.ZAC_IMAGE_URL }}

      - name: Run Trivy Vulnerability Scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.ZAC_IMAGE_URL }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          # limit the severities even when using Sarif
          # or else all vulnerabilities will be reported
          limit-severities-for-sarif: true
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy Scan Results to GitHub Security Tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Snyk to check Docker image for vulnerabilities
        continue-on-error: true
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          sarif: true
          image: ${{ env.ZAC_IMAGE_URL }}
          args: --severity-threshold=high --sarif --sarif-file-output=snyk.sarif

      - name: Upload Snyk Scan Results to GitHub Security Tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'snyk.sarif'