Skip to content

chore(deps): bump actions/upload-artifact from 4.3.1 to 4.3.6 #1122

chore(deps): bump actions/upload-artifact from 4.3.1 to 4.3.6

chore(deps): bump actions/upload-artifact from 4.3.1 to 4.3.6 #1122

Workflow file for this run

name: Security
on:
push:
branches:
- main
pull_request:
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
# Schedule in case of no code changes
schedule:
- cron: '30 0 1,15 * *'
permissions: # added using https://github.com/step-security/secure-repo
contents: read
jobs:
trivy:
name: Trivy scanner
continue-on-error: true
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
pull-requests: read
actions: write
if: (github.actor != 'dependabot[bot]')
steps:
-
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
with:
disable-sudo: true
disable-telemetry: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
ghcr.io:443
github.com:443
pkg-containers.githubusercontent.com:443
-
name: Cancel previous workflows
uses: styfle/cancel-workflow-action@01ce38bf961b4e243a6342cbade0dbc8ba3f0432 # 0.12.0
with:
access_token: ${{ secrets.GITHUB_TOKEN }}
-
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
-
name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # master
with:
scan-type: 'fs'
ignore-unfixed: true
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL'
-
name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 # v3.25.4
with:
sarif_file: 'trivy-results.sarif'