run_vulnerability_scan.yml

name: Trivy Vulnerability Scan

on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  RunVulnerabilityScan:
    permissions:
        contents: write
        pull-requests: write
        actions: read
    runs-on: ubuntu-latest
    steps:        
      - name: Checkout repository
        uses: actions/checkout@v4
      
      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'json'
          output: 'trivy-results.json'
          severity: 'CRITICAL'
          scanners: 'vuln,secret,misconfig'
          trivy-config: ./trivy.yaml
          
      - name: Generate markdown report from Trivy results
        id: generate_report
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const results = JSON.parse(fs.readFileSync('trivy-results.json', {encoding: 'utf8'}));
            let markdown = `# Trivy Scan Results\n\n`;
            
            if (results.Results && results.Results.length > 0) {
              results.Results.forEach((result) => {
                markdown += `## Target: ${result.Target}\n`;
                markdown += `- **Type**: ${result.Type}\n`;
                markdown += `- **Class**: ${result.Class}\n\n`;
                
                if (result.Misconfigurations && result.Misconfigurations.length > 0) {
                  result.Misconfigurations.forEach((misconf, index) => {
                    markdown += `### Misconfiguration ${index + 1}\n`;
                    markdown += `- **Type**: ${misconf.Type}\n`;
                    markdown += `- **ID**: ${misconf.ID}\n`;
                    markdown += `- **Title**: ${misconf.Title}\n`;
                    markdown += `- **Description**: ${misconf.Description}\n`;
                    markdown += `- **Resolution**: ${misconf.Resolution}\n`;
                    markdown += `- **Severity**: ${misconf.Severity}\n\n`;
                  });
                } else {
                  markdown += `No misconfigurations found.\n\n`;
                }
              });
            } else {
              markdown += `No results found.\n`;
            }
            
            fs.writeFileSync('trivy-report.md', markdown);
            return markdown;
          result-encoding: 'string'

    # Todo: maybe later? This is a good idea, but it's not working well with the current version of the gh CLI
    #   - name: Post comment with Trivy results using gh CLI
    #     if: github.event_name == 'pull_request'
    #     run: |
    #       gh pr comment "${{ github.event.pull_request.number }}" --repo ${{ github.repository }} --body "$(cat trivy-report.md)"
    #     env:
    #       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Trivy scan markdown report to GitHub Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: trivy-report
          path: trivy-report.md

      - name: Post comment with artifact link
        if: github.event_name == 'pull_request'
        run: |
          artifact_url="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          comment_body="Here is the Trivy scan report: [View Trivy Report]($artifact_url)"
          gh pr comment "${{ github.event.pull_request.number }}" --body "$comment_body"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}