OpenMetadata/.github/workflows/trivy-scan-openmetadata-server.yml

name: Trivy Scan For OpenMetadata Server Docker Image
on:
  schedule:
    - cron: '15 4 * * *'
  workflow_dispatch:
concurrency: 
  group: trivy-server-scan-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.draft }}
    permissions:
      pull-requests: write
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
            
      - name: Prepare for Docker Build
        id: prepare
        uses: ./.github/actions/prepare-for-docker-build
        with:
          image: openmetadata-server
          tag: trivy
          is_ingestion: false

      - name: Build Docker Image
        run: |
          docker build -t openmetadata-server:trivy -f docker/development/Dockerfile .

      - name: Run Trivy Image Scan
        id: trivy_scan
        uses: aquasecurity/trivy-action@master
        with:
            scan-type: "image"
            image-ref: openmetadata-server:trivy
            hide-progress: false
            ignore-unfixed: true
            severity: "HIGH,CRITICAL,MEDIUM"
            scan-ref: .
            format: 'template'
            template: "@.github/trivy/templates/github.tpl"
            output: $GITHUB_STEP_SUMMARY
        env:
            TRIVY_DISABLE_VEX_NOTICE: "true"