Add Trivy image vulnerability scan

2026-10-14 22:49:49 +03:00
parent b49e4b4b18
commit 60b2631237
1 changed files with 13 additions and 0 deletions
@@ -49,6 +49,19 @@ jobs:
            -t mikhaillobanov/devops-platform:${GITHUB_SHA} \
            .

+        - name: Scan Docker image with Trivy
+          if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+          run: |
+            docker run --rm \
+              -v /var/run/docker.sock:/var/run/docker.sock \
+              -v "$HOME/.cache/trivy:/root/.cache/" \
+              aquasec/trivy:0.76.0 image \
+              --scanners vuln \
+              --severity HIGH,CRITICAL \
+              --ignore-unfixed \
+              --exit-code 1 \
+              mikhaillobanov/devops-platform:${GITHUB_SHA}
+
      - name: Push Docker image
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |