container-scan.yml

name: Container Security Scan
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
permissions:
  contents: read

jobs:
  container-security-scan:
    name: Scan Container for Vulnerabilities
    runs-on: ubuntu-24.04
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      
      - name: Build Docker image for scanning
        run: |
          docker build -t ghcr.io/permify/permify:scan-${{ github.sha }} .
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
        with:
          image-ref: 'ghcr.io/permify/permify:scan-${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'