25 lines
803 B
YAML
25 lines
803 B
YAML
name: Security Scan (SIAX Cloud)
|
|
|
|
# Blocking vulnerability/secret scan on every push/PR + weekly re-run.
|
|
# HIGH/CRITICAL findings must be fixed or carried by an explicit, scoped,
|
|
# time-bounded exception outside this workflow; CI never silently downgrades them.
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 5 * * 1"
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Trivy
|
|
run: |
|
|
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
- name: Trivy fs scan (vulnerability + secret; HIGH/CRITICAL blocking)
|
|
run: |
|
|
trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .
|