From aa35fa6580f297f3b4364040615eca3edbea1f8c Mon Sep 17 00:00:00 2001 From: Mark Sagi-Kazar Date: Thu, 14 Apr 2022 12:50:12 +0200 Subject: [PATCH] ci: wait for container images with container scan Signed-off-by: Mark Sagi-Kazar --- .github/workflows/artifacts.yaml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml index dabdabd7..032efb49 100644 --- a/.github/workflows/artifacts.yaml +++ b/.github/workflows/artifacts.yaml @@ -18,6 +18,8 @@ jobs: - linux/amd64 - linux/arm/v7 - linux/arm64 + outputs: + version: ${{ steps.details.outputs.version }} steps: - name: Checkout @@ -96,17 +98,22 @@ jobs: org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }} org.opencontainers.image.documentation=https://dexidp.io/docs/ + container-scan: + name: Container scan + runs-on: ubuntu-latest + needs: container-images + if: github.event_name == 'push' + + steps: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@0.2.3 with: - image-ref: "ghcr.io/dexidp/dex:${{ steps.details.outputs.version }}" + image-ref: "ghcr.io/dexidp/dex:${{ needs.container-images.outputs.version }}" format: "template" template: "@/contrib/sarif.tpl" output: "trivy-results.sarif" - if: github.event_name == 'push' - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v1 with: sarif_file: "trivy-results.sarif" - if: github.event_name == 'push'