diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6e33866..69efa2c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -69,34 +69,49 @@ jobs: - name: Pushing Docker Image run: docker push ${{ vars.DOCKER_USER }}/eng-frontend:1.${{ github.run_number }}.${{ github.run_attempt}} + # Image-Vuln-Check-Frontend: + # if: contains(github.event.head_commit.message, 'frontend') + # runs-on: ubuntu-24.04 + # needs: [Build-And-Push-Frontend] + # continue-on-error: true + # defaults: + # run: + # shell: bash + # working-directory: frontend/ + # steps: + # - name: Checkout Code + # uses: actions/checkout@v4 + # - name: Run Trivy Vulnerability Scanner + # uses: aquasecurity/trivy-action@0.20.0 + # with: + # image-ref: "docker.io/${{ vars.DOCKER_USER }}/eng-frontend:1.${{ github.run_number }}.${{ github.run_attempt}}" + # format: "table" + # exit-code: "1" + # ignore-unfixed: true + # output: trivy-report-frontend.txt + # vuln-type: "os,library" + # severity: "CRITICAL,HIGH" + # - name: Upload Artifact + # uses: actions/upload-artifact@v4 + # with: + # name: trivy-report-frontend + # path: trivy-report-frontend.txt + Image-Vuln-Check-Frontend: - if: contains(github.event.head_commit.message, 'frontend') runs-on: ubuntu-24.04 needs: [Build-And-Push-Frontend] - continue-on-error: true - defaults: - run: - shell: bash - working-directory: frontend/ steps: - - name: Checkout Code - uses: actions/checkout@v4 - - name: Run Trivy Vulnerability Scanner - uses: aquasecurity/trivy-action@0.20.0 - with: - image-ref: "docker.io/${{ vars.DOCKER_USER }}/eng-frontend:1.${{ github.run_number }}.${{ github.run_attempt}}" - format: "table" - exit-code: "1" - ignore-unfixed: true - output: trivy-report-frontend.txt - vuln-type: "os,library" - severity: "CRITICAL,HIGH" - - name: Upload Artifact - uses: actions/upload-artifact@v4 + - name: Docker Scout + id: docker-scout + uses: docker/scout-action@v1 with: - name: trivy-report-frontend - path: trivy-report-frontend.txt - + command: cves,recommendations + image: docker.io/${{ vars.DOCKER_USER }}/eng-frontend:1.${{ github.run_number }}.${{ github.run_attempt}} + ignore-unchanged: true + only-severities: critical,high + write-comment: true + github-token: ${{ secrets.GITHUB_TOKEN }} + Update-ImgTag-Frontend: runs-on: ubuntu-24.04 needs: [Image-Vuln-Check-Frontend]