[DDS-2006] Updated base branch for scan for 6.x (#280)

dpc-sdp · Aug 20, 2024 · 38d35e1 · 38d35e1
1 parent df352b8
commit 38d35e1
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 20 deletions.
diff --git a/...workflows/vulnerability-scan-schedule.yml → ...kflows/vulnerability-scan-schedule-5x.yml b/...workflows/vulnerability-scan-schedule.yml → ...kflows/vulnerability-scan-schedule-5x.yml
@@ -12,29 +12,12 @@ jobs:
     strategy:
       matrix:
         images: ${{ fromJson(vars.IMAGES) }}
-        branches: ${{ fromJson(vars.BRANCHES) }}
         exclude:
-          - images: ci-builder
-            branches: 4.x
-          - images: clamav
-            branches: 4.x
-          - images: elasticsearch
-            branches: 4.x
-          - images: mailhog
-            branches: 4.x
-          - images: mariadb
-            branches: 4.x
-          - images: nginx
-            branches: 4.x
-          - images: php-cli
-            branches: 4.x
-          - images: php-fpm
-            branches: 4.x
-          - images: ripple-static
-            branches: 4.x
           - images: mailpit
-            branches: 5.x
     steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: 5.x
       - name: Scan for vulnerabilities
         id: scan
         uses: crazy-max/ghaction-container-scan@v3

diff --git a/.github/workflows/vulnerability-scan-schedule-6x.yml b/.github/workflows/vulnerability-scan-schedule-6x.yml
@@ -0,0 +1,29 @@
+name: vulnerability-scan-schedule
+run-name: Scheduled CVE vulnerability scan of published images.
+env:
+  REGISTRY: ghcr.io
+on:
+  schedule:
+    - cron: '0 22 * * 3'
+jobs:
+  vulnerability-scan-schedule:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        images: ${{ fromJson(vars.IMAGES) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: 6.x
+      - name: Scan for vulnerabilities
+        id: scan
+        uses: crazy-max/ghaction-container-scan@v3
+        with:
+          image: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.images }}:${{matrix.branches}}
+          dockerfile: ./images/${{ matrix.images }}
+      - name: Upload SARIF file
+        if: ${{ steps.scan.outputs.sarif != '' }}
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}