periodic-scanner-quay.yaml

---
name: (cron job) Fetch security scan results from quay
on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:
permissions: read-all
jobs:
  build-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@v4

      - name: Fetch results
        id: fetch-results
        run: |
          ./ci/images/vulnerability-scan/scan.sh | tee /tmp/vulnerability-scan.log
          echo "VULNERABILITIES_EXIST=$(tail -1 /tmp/vulnerability-scan.log)" >> $GITHUB_OUTPUT
        env:
          AUTH_BEARER_TOKEN: ${{ secrets.AUTH_BEARER_TOKEN }}
          images: (
            "ci-runner"
            "dependencies-update"
            "e2e-test-runner"
            "quay-upload"
            "static-checks"
            "vulnerability-scan"
            )
          quay_url: "https://quay.io/api/v1/repository/redhat-pipeline-service"

      - name: Check results
        id: check-results
        if: always()
        run: |
          res=(${{ steps.fetch-results.outputs.VULNERABILITIES_EXIST }})
          if [[ "${res[*]}" =~ "1" ]];then
            echo "Vulnerabilities found. Please check the fetch-results step for further details."
            exit 1
          else
            echo "No Vulnerabilities found"
          fi