pr-trivy-scan.yaml

name: Trivy
on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  trivy_scan:
    runs-on: ubuntu-latest
    name: Scan
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy
        uses: aquasecurity/trivy-action@0.29.0
        env:
          TRIVY_LIGHT: "true"
        with:
          scan-type: "fs"
          scan-ref: "."
          ignore-unfixed: true
          format: "json"
          output: "trivy-report.json"
          severity: "CRITICAL,HIGH,MEDIUM,LOW"
          exit-code: 1

      - name: Build Trivy PR comment
        if: always()
        run: |
          echo "## Trivy report summary" > trivy-comment.md
          echo "<details>" >> trivy-comment.md
          echo "<summary>show details</summary>" >> trivy-comment.md
          echo "" >> trivy-comment.md
          echo "\`\`\`json" >> trivy-comment.md
          cat trivy-report.json >> trivy-comment.md
          echo "\`\`\`" >> trivy-comment.md
          echo "</details>" >> trivy-comment.md
          cat trivy-comment.md >> $GITHUB_STEP_SUMMARY

      - uses: mshick/add-pr-comment@v2
        name: Add PR comment
        if: always()
        with:
          message-id: trivy-report
          refresh-message-position: true
          message-path: |
            trivy-comment.md