FuTuRe/.github/workflows/docker-scan.yml at main · Good-Coded/FuTuRe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
name: Docker Image Scanning (Trivy)
# Issue #772 — Add Docker image vulnerability scanning to CI

on:
  push:
    branches: [main, 'feature/**']
    paths:
      - 'backend/Dockerfile'
      - 'frontend/Dockerfile'
      - 'backend/**'
      - 'frontend/**'
      - '.trivyignore'
      - '.github/workflows/docker-scan.yml'
  pull_request:
    branches: [main]
  schedule:
    # Nightly scan to catch newly published CVEs against already-merged images
    - cron: '0 3 * * *'

jobs:
  trivy-backend:
    name: Trivy — Backend Image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Build backend Docker image
        run: docker build -t future-backend:${{ github.sha }} ./backend

      - name: Run Trivy on backend image
        uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # v0.31.0
        with:
          image-ref: future-backend:${{ github.sha }}
          format: sarif
          output: trivy-backend.sarif
          severity: CRITICAL,HIGH
          exit-code: '1'
          ignore-unfixed: true
          trivyignores: .trivyignore

      - name: Upload backend Trivy SARIF report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: trivy-backend-report-${{ github.sha }}
          path: trivy-backend.sarif
          retention-days: 30

  trivy-frontend:
    name: Trivy — Frontend Image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Build frontend Docker image
        run: docker build -t future-frontend:${{ github.sha }} ./frontend

      - name: Run Trivy on frontend image
        uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # v0.31.0
        with:
          image-ref: future-frontend:${{ github.sha }}
          format: sarif
          output: trivy-frontend.sarif
          severity: CRITICAL,HIGH
          exit-code: '1'
          ignore-unfixed: true
          trivyignores: .trivyignore

      - name: Upload frontend Trivy SARIF report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: trivy-frontend-report-${{ github.sha }}
          path: trivy-frontend.sarif
          retention-days: 30

  docker-scan-gate:
    name: Docker Scan Gate
    runs-on: ubuntu-latest
    needs: [trivy-backend, trivy-frontend]
    if: always()
    steps:
      - name: Check scan results
        run: |
          if [ "${{ needs.trivy-backend.result }}" != "success" ]; then
            echo "❌ Backend image scan failed — HIGH/CRITICAL CVEs detected"
            exit 1
          fi
          if [ "${{ needs.trivy-frontend.result }}" != "success" ]; then
            echo "❌ Frontend image scan failed — HIGH/CRITICAL CVEs detected"
            exit 1
          fi
          echo "✅ Docker image scans passed — no unfixed HIGH/CRITICAL CVEs"

      - name: Comment PR on scan failure
        if: failure() && github.event_name == 'pull_request'
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '🔒 **Docker image scan failed.** HIGH or CRITICAL CVEs were detected in the container image(s). Download the `trivy-*-report` artifacts for details. Add justified suppressions to `.trivyignore` or update the base image to remediate.'
            })