trivy-db-refresh.yml

name: Trivy Database Refresh

on:
  workflow_dispatch:
  schedule:
    - cron: "23 3 * * *" # Attempting to run at an off-peak time

permissions:
  id-token: write
  contents: read

jobs:
  trivy-db-refresh:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Configure AWS credentials using OIDC
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/security-tools-apply
          role-session-name: ECRPush
          aws-region: us-east-1

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
        with:
          registry-type: public

      - name: Refresh Trivy Databases
        run: |
          ./bin/generate_sbom/trivy_db_refresh.sh trivy-db:latest ${{ vars.TRIVY_DB_REPOSITORY }}
          ./bin/generate_sbom/trivy_db_refresh.sh trivy-java-db:1 ${{ vars.TRIVY_JAVA_DB_REPOSITORY }}

      - name: Logout of Amazon ECR
        run: docker logout ${{ steps.login-ecr.outputs.registry }}