Keycloak

1
name: Trivy
2

3
on:
4
  workflow_dispatch:
5

6
defaults:
7
  run:
8
    shell: bash
9

10
jobs:
11

12
  analysis:
13
    name: Vulnerability scanner for nightly containers
14
    runs-on: ubuntu-latest
15
    if: github.repository == 'keycloak/keycloak'
16
    strategy:
17
      matrix:
18
        container: [keycloak, keycloak-operator]
19
      fail-fast: false
20
    steps:
21
      - name: Run Trivy vulnerability scanner
22
        uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d
23
        with:
24
          image-ref: quay.io/keycloak/${{ matrix.container}}:nightly
25
          format: template
26
          template: '@/contrib/sarif.tpl'
27
          output: trivy-results.sarif
28
          severity: MEDIUM,CRITICAL,HIGH
29
          ignore-unfixed: true
30
          security-checks: vuln
31
          timeout: 15m
32

33
      - name: Upload Trivy scan results to GitHub Security tab
34
        uses: github/codeql-action/upload-sarif@v3
35
        with:
36
          sarif_file: trivy-results.sarif
37