security-scan.yml

name: Security Scan

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

  schedule:
    - cron: "31 1,12 * * *"

  push:
    branches:
      - master

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  security-scan:
    runs-on: ubuntu-22.04
    timeout-minutes: 5

    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.29.0
        env:
          TRIVY_USERNAME: ${{ github.repository_owner }}
          TRIVY_PASSWORD: ${{ github.token }}
        with:
          scan-type: "fs"
          scan-path: "."
          ignore-unfixed: true
          severity: "CRITICAL,HIGH"
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3.28.0
        with:
          sarif_file: "trivy-results.sarif"