research-vuln-scan.yml

name: trivy & grype & sarif & docker scout vulnerability scan

on:
  push:
    branches: [ "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main" ]

permissions:
  contents: read

jobs:
  trivy:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    name: Trivy
    runs-on: self-hosted-generic
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0
        with:
          image-ref: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'trivy-results.sarif'
          severity: 'MEDIUM,HIGH,CRITICAL'
          github-pat: ${{ secrets.GITHUB_TOKEN }} # or ${{ secrets.github_pat_name }} if you're using a PAT
        env:
          TRIVY_USERNAME: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
          TRIVY_PASSWORD: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
        with:
          sarif_file: 'trivy-results.sarif'
          category: ${{ github.jobs[github.job].name }}

  grype:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    name: Grype
    runs-on: self-hosted-generic
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Login to Greenbone Product container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
        with:
          registry: ${{ vars.GREENBONE_REGISTRY }}
          username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
          password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}

      - name: Run the Anchore Grype scan action
        uses: anchore/scan-action@869c549e657a088dc0441b08ce4fc0ecdac2bb65
        id: grype
        with:
          image: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
          fail-build: false
          severity-cutoff: medium

      - name: Upload grype vulnerability report
        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
        with:
          sarif_file: ${{ steps.grype.outputs.sarif }}
          category: ${{ github.jobs[github.job].name }}

  docker-scout:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
      pull-requests: write
    name: "Docker Scout"
    runs-on: self-hosted-generic
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Login to Greenbone Product container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
        with:
          registry: ${{ vars.GREENBONE_REGISTRY }}
          username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
          password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}

      - name: Analyze for critical and high CVEs
        id: docker-scout-cves
        if: ${{ github.event_name != 'pull_request_target' }}
        uses: docker/scout-action@v1
        with:
          command: cves
          image: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
          sarif-file: sarif.output.json
          summary: true
          dockerhub-user: ${{ secrets.DOCKERHUB_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
          only-severities: critical, high, medium

      - name: Upload docker scout SARIF result
        id: upload-sarif
        if: ${{ github.event_name != 'pull_request_target' }}
        uses: github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
        with:
          sarif_file: sarif.output.json
          category: ${{ github.jobs[github.job].name }}