scan_images.yaml

name: Scan existing images
on:
  schedule:
    - cron: '10 3 * * SAT'
  workflow_dispatch:

permissions:
  contents: read
  packages: read
  security-events: write

jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        label:
          - 'latest'
          - 'beta'
    name: ${{ matrix.label }}
    runs-on: ubuntu-22.04
    steps:
      - name: Docker login
        if: ${{ env.TAGS }}
        env:
          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          echo ${GHCR_TOKEN} |
          docker login ghcr.io -u ${{ github.repository_owner }}
          --password-stdin
      - name: Define image name
        run: |
          echo "IMAGE=ghcr.io/${{ github.repository_owner }}/hello-ghcr-meow:${{ matrix.label }}" >>${GITHUB_ENV}
      - name: Get container image
        run: |
          docker pull ${IMAGE}
      - name: Read image revision
        run: |
          echo "IMAGE_REF=$(docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' ${IMAGE})" >>${GITHUB_ENV}
      - uses: actions/checkout@v4
        with:
          ref: ${{ env.IMAGE_REF }}
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.29.0
        with:
          image-ref: '${{ env.IMAGE }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'
      - name: Docker logout
        if: always()
        run: |
          docker logout ghcr.io