trivy-scan.yml

name: Trivy

on:
  workflow_dispatch:
  schedule:
    - cron: '30 20 * * *'

jobs:
  ubuntu-build:
    name: Build on Ubuntu
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up JDK 17
        uses: actions/setup-java@v2
        with:
          distribution: 'temurin'
          java-version: 17.0.7
      - name: Build with Gradle
        env:
          packageUser: ${{ github.actor }}
          packagePAT: ${{ secrets.GITHUB_TOKEN }}
        run: ./gradlew build -x check -x test
      - name: Create lib directory if not exists
        run: mkdir -p ballerina/lib
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'rootfs'
          scan-ref: '/github/workspace/ballerina/lib'
          format: 'table'
          timeout: '10m0s'
          exit-code: '1'
      - name: Notify failure
        if: ${{ failure() }}
        run: |
          curl -X POST \
          'https://api.github.com/repos/ballerina-platform/ballerina-release/dispatches' \
          -H 'Accept: application/vnd.github.v3+json' \
          -H 'Authorization: Bearer ${{ secrets.BALLERINA_BOT_TOKEN }}' \
          --data "{
            \"event_type\": \"notify-trivy-failure\",
            \"client_payload\": {
              \"repoName\": \"module-ballerinax-h2.driver\",
              \"workflow\": \"Trivy\"
            }
          }"