From 1bc2e8bc70e38ba3008709709ae0d5302912074e Mon Sep 17 00:00:00 2001 From: grohiro Date: Wed, 18 Feb 2026 10:59:03 +0900 Subject: [PATCH] trivy --- .github/workflows/trivy.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 .github/workflows/trivy.yml diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 0000000..0d1154d --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,31 @@ +name: Trivy Security Scan + +on: + pull_request: + branches: + - master + - main + +jobs: + trivy-scan: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run Trivy vulnerability scanner (filesystem) + uses: aquasecurity/trivy-action@master + with: + scan-type: 'fs' + scan-ref: '.' + severity: 'HIGH,CRITICAL' + exit-code: '1' + ignore-unfixed: true + + - name: Run Trivy config scanner + uses: aquasecurity/trivy-action@master + with: + scan-type: 'config' + scan-ref: '.' + severity: 'MEDIUM,HIGH,CRITICAL' + exit-code: '1'