Trivy Security Scan #164

	name: Trivy Security Scan

	on:
	push:
	branches:
	- master
	pull_request:
	branches:
	- master
	schedule:
	# Run daily at 00:00 UTC
	- cron: '0 0 * * *'
	workflow_dispatch: # Allow manual trigger

	permissions:
	contents: read
	security-events: write # Required for uploading SARIF results

	jobs:
	trivy-scan:
	name: Trivy Security Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: Run Trivy vulnerability scanner (source code)
	uses: aquasecurity/trivy-action@0.33.1
	with:
	scan-type: 'fs'
	scan-ref: '.'
	scanners: 'vuln,secret,misconfig'
	format: 'sarif'
	output: 'trivy-results.sarif'
	severity: 'CRITICAL,HIGH,MEDIUM'
	ignore-unfixed: true

	- name: Upload Trivy results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v4
	if: always()
	with:
	sarif_file: 'trivy-results.sarif'

	- name: Run Trivy scanner (table output for logs)
	uses: aquasecurity/trivy-action@0.33.1
	if: always()
	with:
	scan-type: 'fs'
	scan-ref: '.'
	scanners: 'vuln,secret,misconfig'
	format: 'table'
	severity: 'CRITICAL,HIGH,MEDIUM'
	ignore-unfixed: true
	exit-code: '1'

Provide feedback