docker-php/.github/workflows/security.yml at main · ToshY/docker-php · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
name: Security Check

on:
  schedule:
    - cron: '30 4 * * *'
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        image:
          - ghcr.io/toshy/php:8.2-fpm-trixie
          - ghcr.io/toshy/php:8.3-fpm-trixie
          - ghcr.io/toshy/php:8.4-fpm-trixie
          - ghcr.io/toshy/php:8.5-fpm-trixie
          - ghcr.io/toshy/php:8.2-fpm-trixie-ffmpeg
          - ghcr.io/toshy/php:8.3-fpm-trixie-ffmpeg
          - ghcr.io/toshy/php:8.4-fpm-trixie-ffmpeg
          - ghcr.io/toshy/php:8.5-fpm-trixie-ffmpeg
          - ghcr.io/toshy/php:8.2-fpm-trixie-otel
          - ghcr.io/toshy/php:8.3-fpm-trixie-otel
          - ghcr.io/toshy/php:8.4-fpm-trixie-otel
          - ghcr.io/toshy/php:8.5-fpm-trixie-otel
          - ghcr.io/toshy/php:8.2-fpm-trixie-otel-ffmpeg
          - ghcr.io/toshy/php:8.3-fpm-trixie-otel-ffmpeg
          - ghcr.io/toshy/php:8.4-fpm-trixie-otel-ffmpeg
          - ghcr.io/toshy/php:8.5-fpm-trixie-otel-ffmpeg
    steps:
      - name: Scan for vulnerabilities
        uses: crazy-max/ghaction-container-scan@v4
        with:
          image: ${{ matrix.image }}
          severity_threshold: CRITICAL
          annotations: true
        env:
          TRIVY_TIMEOUT: 5m
          TRIVY_IGNORE_UNFIXED: true
          TRIVY_DISABLE_VEX_NOTICE: true