37 lines
967 B
YAML
37 lines
967 B
YAML
name: Docker Scout, verify images
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 0 */1 * *"
|
|
workflow_dispatch:
|
|
env:
|
|
# Use docker.io for Docker Hub if empty
|
|
REGISTRY: ghcr.io
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
jobs:
|
|
verify_ee_image_vulnerabilities:
|
|
runs-on: ubicloud
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
steps:
|
|
# Login against a Docker registry except on PR
|
|
# https://github.com/docker/login-action
|
|
- name: Log into docker
|
|
uses: docker/login-action@v2.1.0
|
|
with:
|
|
username: windmilllabs
|
|
password: ${{ secrets.DOCKER_PAT }}
|
|
|
|
- name: Docker Scout
|
|
id: docker-scout
|
|
uses: docker/scout-action@v1
|
|
with:
|
|
command: quickview,cves
|
|
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:main
|
|
only-severities: critical,high
|
|
write-comment: false
|
|
github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
|