Add trivy container scan to end of docker build workflow

Sage-Bionetworks · Mar 6, 2024 · 0b5fd50 · 0b5fd50
1 parent 9360ea8
commit 0b5fd50
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/.github/workflows/docker_build.yml b/.github/workflows/docker_build.yml
@@ -54,4 +54,12 @@ jobs:
           build-args: |
             DCA_VERSION=${{ env.DCA_VERSION }}
 
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ env.IMAGE_PATH }}:${{ env.DCA_VERSION }}'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH'