From 08134aefa515038f0dd2d1b8a94e65938a6a5c66 Mon Sep 17 00:00:00 2001
From: paspo <paolo@asperti.com>
Date: Thu, 25 Jan 2024 09:11:50 +0100
Subject: [PATCH] periodic vulnerability scan

---
 .gitea/workflows/vulnscan.yaml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 .gitea/workflows/vulnscan.yaml

diff --git a/.gitea/workflows/vulnscan.yaml b/.gitea/workflows/vulnscan.yaml
new file mode 100644
index 0000000..9bb6a0b
--- /dev/null
+++ b/.gitea/workflows/vulnscan.yaml
@@ -0,0 +1,31 @@
+name: Vulnerability Scan
+
+on:
+  schedule:
+    - cron: "0 14 * * *"
+  workflow_dispatch:
+
+jobs:
+  scan:
+    name: Daily Vulnerability Scan
+    runs-on: ubuntu-latest
+    container:
+      image: catthehacker/ubuntu:act-latest
+
+    steps:
+      - name: Pull docker image
+        run: docker pull docker.asperti.com/paspo/ftps:latest
+      #  run: docker pull git.asperti.com/paspo/docker-ftps:latest
+
+      - name: Run Trivy vulnerability scanner
+        id: scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "docker.asperti.com/paspo/ftps:latest"
+          # image-ref: "git.asperti.com/paspo/docker-ftps:latest"
+          format: "json"
+          output: "trivy-results.json"
+
+      # if some vulnerability is found, we fail
+      - name: check output
+        run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi