cd-security-scan.yaml

name: CD Security Scan   
             
on:
  schedule:
    - cron: '0 */24 * * *'
    
jobs:
  scan:
    runs-on: ubuntu-latest
    
    env:
      DOCKERHUB_SLUG: "madnuttah/unbound"  
      
    steps:         
      - name: Checkout source
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Login to Dockerhub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        if: ${{ github.event_name != 'pull_request' }}
        with:
          image-ref: ${{ env.DOCKERHUB_SLUG }}:latest          
          exit-code: '1'
          ignore-unfixed: true
          scan-type: image
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          format: 'sarif'
          output: 'scan-results-latest.sarif'
      
      - name: Upload SARIF result
        id: UPLOAD_SARIF
        if: ${{ github.event_name != 'pull_request' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'scan-results-latest.sarif'
          
      - name: Docker Scout CVEs
        uses: docker/scout-action@v1
        if: ${{ github.event_name != 'pull_request' }}
        with:
          command: cves
          image: ${{ env.DOCKERHUB_SLUG }}:latest 
          only-fixed: true
          only-severities: critical,high
          write-comment: true
          github-token: ${{ secrets.GITHUB_TOKEN }} 
          exit-code: false