diff --git a/.github/workflows/vulnerability-scan-schedule-5x.yml b/.github/workflows/vulnerability-scan-schedule-5x.yml new file mode 100644 index 00000000..8eeef375 --- /dev/null +++ b/.github/workflows/vulnerability-scan-schedule-5x.yml @@ -0,0 +1,31 @@ +name: vulnerability-scan-schedule +run-name: Scheduled CVE vulnerability scan of published images. +env: + REGISTRY: ghcr.io +on: + schedule: + - cron: '0 22 * * 3' +jobs: + vulnerability-scan-schedule: + if: github.event_name == 'schedule' + runs-on: ubuntu-latest + strategy: + matrix: + images: ${{ fromJson(vars.IMAGES) }} + exclude: + - images: mailpit + steps: + - uses: actions/checkout@v4 + with: + ref: 5.x + - name: Scan for vulnerabilities + id: scan + uses: crazy-max/ghaction-container-scan@v3 + with: + image: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.images }}:${{matrix.branches}} + dockerfile: ./images/${{ matrix.images }} + - name: Upload SARIF file + if: ${{ steps.scan.outputs.sarif != '' }} + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ${{ steps.scan.outputs.sarif }} diff --git a/.github/workflows/vulnerability-scan-schedule.yml b/.github/workflows/vulnerability-scan-schedule-6x.yml similarity index 100% rename from .github/workflows/vulnerability-scan-schedule.yml rename to .github/workflows/vulnerability-scan-schedule-6x.yml