Security #151

	name: Security

	on:
	push:
	branches: [master]
	schedule:
	- cron: '0 11 * * 2'

	jobs:
	dockerscan:
	name: Docker Scan
	runs-on: ubuntu-latest
	steps:
	-
	uses: actions/[email protected]
	with:
	fetch-depth: 0
	-
	name: Set env
	id: vars
	run: echo ::set-output name=RELEASE_VERSION::$(git describe --match "[0-9].[0-9].[0-9]*" --tags $(git rev-list --tags --max-count=1))
	-
	name: Docker login
	env:
	USER: hazcod
	REGISTRY: ghcr.io
	run: echo "${{ secrets.PACKAGE_TOKEN }}" \| docker login -u "${USER}" --password-stdin "${REGISTRY}"
	-
	name: Docker pull
	run: docker pull "ghcr.io/ironpeakservices/iron-alpine/iron-alpine:${{ steps.vars.outputs.RELEASE_VERSION }}"
	-
	name: Run vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: 'ghcr.io/ironpeakservices/iron-alpine/iron-alpine:${{ steps.vars.outputs.RELEASE_VERSION }}'
	format: 'template'
	template: '@/contrib/sarif.tpl'
	output: 'trivy-results.sarif'
	ignore-unfixed: true
	severity: 'CRITICAL,HIGH,MEDIUM'
	-
	name: Upload Trivy scan results to Security tab
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback