trivy-workflow.yml

name: SEC - Container Scan - Trivy

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  trivy_web_container:
    name: AquaSec Trivy Web Container Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      
      - name: Build the Web container image
        working-directory: ./Application-Source-Code
        run: docker build . --tag localbuild/webimage:latest --file src/Web/Dockerfile
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'image'
          image-ref: 'localbuild/webimage:latest'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' #UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
          format: 'table'

      - name: Generate SARIF Report
        uses: aquasecurity/trivy-action@master
        if: ${{ success() || failure() }}
        with:
          scan-type: 'image'
          image-ref: 'localbuild/webimage:latest'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
          format: 'sarif'
          output: 'trivy-web-container-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: ${{ always() }}
        with:
          sarif_file: 'trivy-web-container-results.sarif'
  
  trivy_api_container:
    name: AquaSec Trivy API Container Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      
      - name: Build the API container image
        working-directory: ./Application-Source-Code
        run: docker build . --tag localbuild/apiimage:latest --file src/PublicApi/Dockerfile
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'image'
          image-ref: 'localbuild/apiimage:latest'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL' #UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
          format: 'table'

      - name: Generate SARIF Report
        uses: aquasecurity/trivy-action@master
        if: ${{ always() }}
        with:
          scan-type: 'image'
          image-ref: 'localbuild/apiimage:latest'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
          format: 'sarif'
          output: 'trivy-api-container-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: ${{ always() }}
        with:
          sarif_file: 'trivy-api-container-results.sarif'

  trivy_iac:
    name: AquaSec Trivy IaC Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      
      - name: Run Trivy vulnerability scanner in IaC mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: ./Infrastructure-Source-Code/terraform/azure
          hide-progress: false
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'

      - name: Generate SARIF Report
        uses: aquasecurity/trivy-action@master
        if: ${{ always() }}
        with:
          scan-type: 'config'
          scan-ref: ./Infrastructure-Source-Code/terraform/azure
          hide-progress: false
          format: 'sarif'
          exit-code: '1'
          ignore-unfixed: true
          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
          output: 'trivy-iac-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: ${{ always() }}
        with:
          sarif_file: 'trivy-iac-results.sarif'