feat: add fs scan (#3 )

Reviewed-on: t.behrendt/trivy-workflows#3 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
chore: bump trivy-actions (#4 )
2026-02-26 22:06:28 +01:00 · 2026-02-26 21:54:54 +01:00
1 changed files with 35 additions and 8 deletions
--- a/.gitea/workflows/run-trivy-scan.yaml
+++ b/.gitea/workflows/run-trivy-scan.yaml
@@ -23,6 +23,11 @@ on:
        required: false
        type: string
        default: ""
+      scan-fs:
+        description: "Run Trivy file system scan on the repository root."
+        required: false
+        type: boolean
+        default: false
    outputs:
      merged-sarif-artifact:
        description: "Artifact name containing the merged SARIF file (download this artifact; file inside is merged-sarif.json)."
@@ -37,8 +42,8 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.4.4
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.4.4
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
      - run: |
          trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output config-sarif.json .
        env:
@@ -53,11 +58,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.4.4
-      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.4.4 
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5 
      - name: Get images from files
        id: get-images
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@1.4.4
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
        with:
          files: ${{ inputs.image-scan-files }}
      - name: Pull images
@@ -97,7 +102,7 @@ jobs:
          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
      - name: Merge image SARIF files
        if: steps.get-images.outputs.images != '[]' && steps.scan.outputs.count != '0'
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.4
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
        with:
          files: ${{ steps.scan.outputs.files }}
          output-file: image-sarif.json
@@ -110,9 +115,28 @@ jobs:
          name: image-sarif
          path: image-sarif.json

+  fs-scan:
+    if: inputs.scan-fs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
+      - uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
+      - run: |
+          server="${{ inputs.trivy-server-url }}"
+          args=(fs --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output fs-sarif.json --scanners vuln .)
+          [ -n "$server" ] && args+=(--server "$server")
+          trivy "${args[@]}"
+        env:
+          TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
+      - uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4
+        with:
+          name: fs-sarif
+          path: fs-sarif.json
+
  merge:
    runs-on: ubuntu-latest
-    needs: [config-scan, image-scan]
+    needs: [config-scan, image-scan, fs-scan]
    if: always() && (needs.config-scan.result == 'success' || needs.config-scan.result == 'skipped') && (needs.image-scan.result == 'success' || needs.image-scan.result == 'skipped') && (inputs.scan-config || inputs.scan-images)
    outputs:
      merged-sarif-artifact: ${{ steps.outputs.outputs.merged-sarif-artifact }}
@@ -145,12 +169,15 @@ jobs:
          if [ "${{ inputs.scan-images }}" = "true" ] && [ -f image-sarif-artifact/image-sarif.json ]; then
            [ -n "$files" ] && files="$files"$'\n'"  - image-sarif-artifact/image-sarif.json" || files="- image-sarif-artifact/image-sarif.json"
          fi
+          if [ "${{ inputs.scan-fs }}" = "true" ] && [ -f fs-sarif-artifact/fs-sarif.json ]; then
+            [ -n "$files" ] && files="$files"$'\n'"  - fs-sarif-artifact/fs-sarif.json" || files="- fs-sarif-artifact/fs-sarif.json"
+          fi
          echo "files<<EOF" >> "$GITHUB_OUTPUT"
          echo "$files" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
      - name: Merge SARIF files
        id: merge-step
-        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.4
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
        with:
          files: ${{ steps.file-list.outputs.files }}
          output-file: merged-sarif.json
Author	SHA1	Message	Date
Timo Behrendt	96f653553f	feat: add fs scan (#3 ) All checks were successful CD / Release (push) Successful in 21s Details Reviewed-on: t.behrendt/trivy-workflows#3 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>	2026-02-26 22:06:28 +01:00
Timo Behrendt	18b347368a	chore: bump trivy-actions (#4 ) All checks were successful CD / Release (push) Successful in 5s Details Reviewed-on: t.behrendt/trivy-workflows#4 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>	2026-02-26 21:54:54 +01:00