vulnerability-scan-build.yml

name: vulnerability-scan-build
run-name: CVE vulnerability scan of in-development images.
env:
  REGISTRY: ghcr.io
on:
  workflow_run:
    workflows: ["Build and deploy Bay images"]
    types: [completed]

jobs:
  vulnerability-scan-build:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        images: ${{ fromJson(vars.IMAGES) }}
    steps:
      - name: Clean ref_name
        id: sanitise-ref-name
        run: |
          echo "SANITISED-REF-NAME=${{ github.ref_name }}" | tr  '/' '-' >> "$GITHUB_OUTPUT"
      - name: Scan for vulnerabilities
        id: scan
        uses: crazy-max/ghaction-container-scan@v3
        with:
          image: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.images }}:${{ steps.sanitise-ref-name.outputs.SANITISED-REF-NAME }}
          dockerfile: ./images/${{ matrix.images }}
      - name: Upload SARIF file
        if: ${{ steps.scan.outputs.sarif != '' }}
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}