jarvis
b519ad2c33
- trivy-registry-image.yml : scan image conteneur publiee (registry_package published) - trivy-repo-weekly.yml : scan lockfiles hebdo (lundi 06:00) + dispatch manuel Dormants tant que les Actions ne sont pas activees + runner enregistre.
36 lines
1.0 KiB
YAML
36 lines
1.0 KiB
YAML
---
|
|
# Trivy — scan hebdomadaire du dépôt (lockfiles : package-lock.json, go.sum,
|
|
# requirements*.txt, Gemfile.lock, ...). Lundi 06:00 + dispatch manuel.
|
|
name: trivy-repo-weekly
|
|
on:
|
|
schedule:
|
|
- cron: '0 6 * * 1' # lundi 06:00 Europe/Paris (fuseau runner)
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: trivy-repo-weekly
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
scan-fs:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Scan Trivy — lockfiles du dépôt
|
|
uses: aquasecurity/trivy-action@v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
format: table
|
|
exit-code: 1 # échoue sur HIGH/CRITICAL
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: true
|
|
timeout: 15m
|
|
env:
|
|
TRIVY_CACHE_DIR: /tmp/.trivy
|
|
|
|
- name: Résultat
|
|
if: failure()
|
|
run: echo "::warning::Vulnérabilités HIGH/CRITICAL dans les dépendances du dépôt (voir logs ci-dessus)" |