# Copyright 2024-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

# Runs linter for Docker files
name: Trivy

permissions: read-all

on:
  workflow_dispatch:
  push:
  pull_request:
    paths:
      - '**/Dockerfile'
      - '.github/workflows/trivy.yml'
      - '.trivyignore'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  linux:
    name: Trivy
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - name: Clone the git repo
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Run Trivy
        uses: aquasecurity/trivy-action@f9424c10c36e288d5fa79bd3dfd1aeb2d6eae808 # v0.33.0
        with:
          scan-type: 'config'
          hide-progress: false
          format: 'sarif'
          output: 'trivy-results.sarif'
          trivyignores: '.trivyignore'
          # Skip released versions before v1.25.0
          skip-dirs: 'docker/v1.24.0,docker/v1.23.0,docker/v1.22.0,docker/v1.21.0,docker/v1.20.0,docker/v1.19.0,docker/v1.18.0,docker/v1.17.0,docker/v1.16.0,docker/v1.15.0,docker/v1.14.1,docker/v1.14.0,docker/v1.13.0,docker/v1.12.0,docker/v1.11.0,docker/v1.10.0,docker/v1.9.2,docker/v1.9.1'

      - name: Print report
        run: |
          echo "### Trivy report:"
          cat trivy-results.sarif

      - name: Upload Trivy results to Github Security tab
        uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Upload Trivy results
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
            name: trivy-results.sarif
            path: trivy-results.sarif