43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
name: MobilityOps security
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "17 3 * * 1"
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: mobilityops-security
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
images:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Build production images once
|
|
run: |
|
|
docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" \
|
|
--tag mobilityops-api-ci --file backend/Dockerfile .
|
|
docker build --build-arg VCS_REF="$GITHUB_SHA" \
|
|
--tag mobilityops-web-ci frontend
|
|
- name: Scan production images for fixed HIGH and CRITICAL vulnerabilities
|
|
run: |
|
|
for image in mobilityops-api-ci mobilityops-web-ci; do
|
|
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
|
docker.io/aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e \
|
|
image --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed --no-progress "$image"
|
|
done
|
|
- name: Scan repository secrets and misconfiguration
|
|
uses: docker://docker.io/aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e
|
|
with:
|
|
args: fs --scanners misconfig,secret --exit-code 1 --no-progress .
|
|
- name: Remove temporary image tags
|
|
if: always()
|
|
run: docker image rm mobilityops-api-ci mobilityops-web-ci || true
|