trivy_scan_before_release.yml

name: Scan Antrea Docker images for vulnerabilities before release

on:
  pull_request:
    branches:
      - release-*

jobs:
  build:
    if: startsWith(github.event.pull_request.title, 'Release ')
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build Antrea Docker image
      run: |
        ./hack/build-antrea-linux-all.sh --pull
    - name: Run Trivy vulnerability scanner on the antrea-agent Docker image
      uses: aquasecurity/trivy-action@0.24.0
      with:
        scan-type: 'image'
        image-ref: 'antrea/antrea-agent-ubuntu:latest'
        trivy-config: '.trivy.yml'
    - name: Run Trivy vulnerability scanner on the antrea-controller Docker image
      uses: aquasecurity/trivy-action@0.24.0
      with:
        scan-type: 'image'
        image-ref: 'antrea/antrea-controller-ubuntu:latest'
        trivy-config: '.trivy.yml'