Skip to content

v0.1.1

v0.1.1 #71

name: Dependency Security Scan
on:
pull_request:
branches: ['main']
push:
jobs:
trivy:
name: Dependency Scan
runs-on: ubuntu-latest
if: (github.actor != 'dependabot[bot]')
steps:
- name: Checkout code
uses: actions/checkout@v3
# Report all vulnerabilities in CI output
- name: Report on all vulnerabilities
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
hide-progress: true
security-checks: 'vuln' # disable secrets scanning until public
format: 'table'
# Fail the job on critical vulnerabiliies with fix available
- name: Fail on critical vulnerabilities
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
ignore-unfixed: true
hide-progress: true
security-checks: 'vuln' # disable secrets scanning until public
format: 'table'
severity: 'CRITICAL'
exit-code: '1'