trivy.yml

name: Container Security

on:
  push:
    branches: [main]
    paths:
      - 'apps/api/Dockerfile*'
      - 'apps/web/Dockerfile*'
      - 'apps/api/package.json'
      - 'apps/web/package.json'
      - 'package-lock.json'
      - '.github/workflows/trivy.yml'
  pull_request:
    branches: [main]
    paths:
      - 'apps/api/Dockerfile*'
      - 'apps/web/Dockerfile*'
      - 'apps/api/package.json'
      - 'apps/web/package.json'
      - 'package-lock.json'
      - '.github/workflows/trivy.yml'
  schedule:
    # Re-scan weekly on Wednesday at 03:00 UTC to catch newly disclosed CVEs
    - cron: '0 3 * * 3'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  trivy:
    name: Trivy — ${{ matrix.app }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        include:
          - app: api
            dockerfile: apps/api/Dockerfile
          - app: web
            dockerfile: apps/web/Dockerfile

    permissions:
      contents: read
      # Required to upload SARIF results to the GitHub Security tab
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          persist-credentials: false

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4.1.0

      - name: Build ${{ matrix.app }} Docker image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ${{ matrix.dockerfile }}
          push: false
          load: true
          tags: farm-${{ matrix.app }}:${{ github.sha }}
          cache-from: type=gha,scope=${{ matrix.app }}
          cache-to: type=gha,mode=max,scope=${{ matrix.app }}

      # Step 1: generate SARIF covering both CRITICAL and HIGH for the
      # GitHub Security tab (visibility only — never blocks the build).
      - name: Run Trivy — SARIF report (CRITICAL + HIGH)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: farm-${{ matrix.app }}:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: os,library

      # Step 2: gate the build — fails only when CRITICAL CVEs are present.
      # HIGH findings appear in the Security tab above but do not block PRs.
      - name: Run Trivy — gate (CRITICAL only)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: farm-${{ matrix.app }}:${{ github.sha }}
          format: table
          severity: CRITICAL
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: os,library

      - name: Upload SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        # Skip on fork PRs — forks do not receive security-events: write.
        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        # Non-blocking in case permissions are insufficient at runtime.
        continue-on-error: true
        with:
          sarif_file: trivy-results.sarif
          category: trivy-${{ matrix.app }}

      - name: Upload Trivy scan artifact
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: trivy-results-${{ matrix.app }}-${{ github.sha }}
          path: trivy-results.sarif
          retention-days: 30