scan.yaml

name: Scan

on:
  push:
    branches:
      - main
      - release-**
    tags: [ 'v[0-9]+.[0-9]+-tetrate-v[0-9]+' ]  # v1.16-tetrate-v7
  pull_request:
    branches:
      - main
      - release-**
  workflow_dispatch: {}

env:
  GOPROXY: https://proxy.golang.org

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      IMG: local/kubegres:scan
      PLATFORMS: linux/amd64
    steps:
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: false
      - uses: docker/setup-qemu-action@v3
        with:
          platforms: amd64
      - uses: docker/setup-buildx-action@v3
      - uses: actions/checkout@v4
      - run: make docker-build
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: local/kubegres:scan-amd64
          format: table
          exit-code: 1
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH,MEDIUM'