cost-model/.github/workflows/vulnerability-scan.yaml

name: Trivy Vulnerability Scanner

permissions: {}

on:
  pull_request:
    branches:
      - develop
  push:
    branches:
      - develop
  merge_group:
    types: [checks_requested]

jobs:
  scan:
    name: Scan for Vulnerabilities
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          persist-credentials: false

      - name: Install Trivy
        # Pinned release verified by checksum. To bump, take the Linux-64bit
        # hash from trivy_<version>_checksums.txt on the release page.
        env:
          TRIVY_VERSION: 0.74.0
          TRIVY_SHA256: 2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
        run: |
          curl -sSfL -o trivy.tar.gz \
            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
          echo "${TRIVY_SHA256}  trivy.tar.gz" | sha256sum -c -
          tar -xzf trivy.tar.gz -C /usr/local/bin trivy
          rm trivy.tar.gz
          trivy --version

      - name: Run Trivy scan
        id: trivy-scan
        continue-on-error: true
        run: |
          # Generate SARIF report first
          trivy fs \
            --format sarif \
            --output trivy-results.sarif \
            --severity CRITICAL,HIGH \
            --pkg-types os,library \
            --no-progress .

          # Generate JSON report and fail step if vulnerabilities are found
          trivy fs \
            --format json \
            --output trivy-results.json \
            --severity CRITICAL,HIGH \
            --pkg-types os,library \
            --no-progress \
            --exit-code 1 .

      - name: Upload Trivy JSON report as artifact
        if: steps.trivy-scan.outcome == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: trivy-json-report
          path: trivy-results.json
          retention-days: 1

      - name: Upload SARIF to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
        with:
          sarif_file: 'trivy-results.sarif'
          category: trivy-fs

      - name: Print vulnerability details and fail job
        
        if: steps.trivy-scan.outcome == 'failure'
        run: |
          echo "🛑 Trivy scan found CRITICAL or HIGH severity vulnerabilities. Details:"
          echo "--------------------------------------------------------------------"
          # Parse the JSON report and print a summary of each vulnerability
          jq -r '.Results[] | .Target as $target | if .Vulnerabilities then .Vulnerabilities[] | "File: \($target)\nPackage: \(.PkgName) (\(.InstalledVersion))\nID: \(.VulnerabilityID)\nSeverity: \(.Severity)\nLink: \(.PrimaryURL)\n--------------------------------------------------------------------" else empty end' trivy-results.json
          # Exit with a failure code to fail the workflow
          exit 1