Trivy

docs: improve custom certificate installation guide (#9650) #3201

	name: Trivy

	on:
	push:
	branches:
	- "main"
	schedule:
	- cron: '55 17 * * 5'

	permissions:
	contents: read

	jobs:
	image-scan:
	permissions:
	contents: read # for actions/checkout to fetch code
	name: Image Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	# We need to fetch tags so go binary will be built with the recent vX.Y.Z-rc.0 tag,
	# which will help to avoid false positives in trivy scan.
	# `fetch-tags: true` doesn't work: https://github.com/actions/checkout/issues/1471
	# As a workaround `filter: tree:0` is used to create a treeless clone.
	# See:
	# https://github.com/actions/checkout/issues/1471#issuecomment-1755639487
	# https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
	with:
	fetch-depth: 0
	filter: tree:0

	- name: Build an image from Dockerfile
	run: \|
	IMAGE=envoy-proxy/gateway-dev TAG=${{ github.sha }} make image

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
	with:
	image-ref: envoy-proxy/gateway-dev:${{ github.sha }}
	exit-code: '1'
	ignore-unfixed: true

Navigation Menu