Show only one tip on first start #592
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trivy Security Scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| # Weekly full scan, Mondays 06:00 UTC. | |
| - cron: "0 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Cancel superseded PR runs; non-PR runs get a unique group so they are never | |
| # interrupted (mirrors ci.yml). | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Blocking gate on PRs and pushes to main: fail only on fixable CRITICAL/HIGH | |
| # vulnerabilities in Go dependencies, so a red check always has an actionable | |
| # fix (bump the dependency). Vulns with no upstream fix don't wedge every PR. | |
| scan-pr: | |
| name: Dependency Scan | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| security-events: write # upload SARIF to code scanning | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # SARIF report for the Security tab covers all severities and never fails | |
| # the job (the gate below owns pass/fail). trivy-action ignores severity | |
| # filters when format is sarif, so this cannot double as the gate. | |
| - name: Run Trivy (SARIF report) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scanners: vuln | |
| format: sarif | |
| output: trivy-results.sarif | |
| # Fork-PR tokens have no security-events:write, so skip the upload there | |
| # (the scan + gate still run). | |
| - name: Upload SARIF to code scanning | |
| if: always() && github.event.pull_request.head.repo.fork != true | |
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| # The blocking gate: fail only on fixable CRITICAL/HIGH vulnerabilities. | |
| - name: Run Trivy (fixable CRITICAL/HIGH gate) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scanners: vuln | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| format: table | |
| # Weekly full scan: every severity, including vulns with no fix yet. New CVEs | |
| # land against unchanged code, so this catches what the PR gate never sees. | |
| # Results go to the Security tab (code scanning) — watchers subscribed to | |
| # security alerts get notified there, no Slack/webhook plumbing. | |
| scan-weekly: | |
| name: Full Scan | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| security-events: write # upload SARIF to code scanning | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run Trivy (all severities) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scanners: vuln | |
| format: sarif | |
| output: trivy-results.sarif | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| sarif_file: trivy-results.sarif |