public/actions
Public Access
1
0 Fork 0
Code Pull Requests Actions Activity

Trivy scan gate #1

Merged
peet merged 2 commits from trivy-scan-gate into main 2026-08-29 09:58:37 +02:00
Conversation 0 Commits 2 Files Changed 2
+3 -2
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit ec5a498266 - Show all commits
podman-build-publish/action.yaml
+3 -2
View File
@@ -178,10 +178,11 @@ runs:
first_tag="$(printf '%s\n' "${{ inputs.tags }}" | tr ', ' '\n\n' | sed '/^$/d' | head -n1)" first_tag="$(printf '%s\n' "${{ inputs.tags }}" | tr ', ' '\n\n' | sed '/^$/d' | head -n1)"
# Trivy cannot read podman's storage under a custom --root, so scan # Trivy cannot read podman's storage under a custom --root, so scan
# an exported archive of the image instead. # an exported archive instead. Must be docker-archive: trivy's
# --input does not understand oci-archive tarballs (verified).
archive="${RUNNER_TEMP}/trivy-scan-image.tar" archive="${RUNNER_TEMP}/trivy-scan-image.tar"
rm -f "${archive}" rm -f "${archive}"
podman "${podman_args[@]}" save --format oci-archive -o "${archive}" "${image_base}:${first_tag}" podman "${podman_args[@]}" save --format docker-archive -o "${archive}" "${image_base}:${first_tag}"
echo "Scanning ${image_base}:${first_tag} (fail on: ${{ inputs.scan-severity }}, fixed only)" echo "Scanning ${image_base}:${first_tag} (fail on: ${{ inputs.scan-severity }}, fixed only)"
trivy image \ trivy image \