Trivy #145

	name: Trivy

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]
	schedule:
	- cron: "19 7 * * 0"

	jobs:
	build:
	name: Build
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with: { fetch-depth: 0 }

	- name: Set up Go
	uses: actions/setup-go@v5
	with: { go-version-file: go.mod }

	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@v5
	with:
	version: latest
	args: build --clean --snapshot

	- name: Archive artifacts for use in Docker build
	uses: actions/upload-artifact@v4
	with:
	name: dist
	path: \|
	dist

	analyze:
	name: Analyze with Trivy
	needs: build
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Download build artifacts
	uses: actions/download-artifact@v4
	with:
	name: dist
	path: dist

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Build and push the image
	uses: docker/build-push-action@v5
	with:
	context: .
	push: false
	load: true
	tags: "spacelift-promex:${{ github.sha }}"

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "spacelift-promex:${{ github.sha }}"
	format: "sarif"
	output: "trivy-results.sarif"
	severity: "CRITICAL,HIGH"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-results.sarif"
	category: "Trivy"

Provide feedback