ci-dependency-scan.yml

name: Dependency Security Scan

on:
  pull_request: 
    branches: ['main']
  push:

jobs:
  trivy:
    name: Dependency Scan
    runs-on: ubuntu-latest
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      # Report all vulnerabilities in CI output
      - name: Report on all vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          hide-progress: true
          security-checks: 'vuln' # disable secrets scanning until public
          format: 'table'
          
      # Fail the job on critical vulnerabiliies with fix available
      - name: Fail on critical vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          hide-progress: true
          security-checks: 'vuln' # disable secrets scanning until public
          format: 'table'
          severity: 'CRITICAL'
          exit-code: '1'