docker-scan.yml

# The contents of this file are subject to the terms of the Common Development and
# Distribution License (the License). You may not use this file except in compliance with the
# License.
#
# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
# specific language governing permission and limitations under the License.
#
# When distributing Covered Software, include this CDDL Header Notice in each file and include
# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
# Header, with the fields enclosed by brackets [] replaced by your own identifying
# information: "Portions copyright [year] [name of copyright owner]".
#
# Copyright 2026 3A Systems, LLC.

# Scans the published Docker image for known vulnerabilities: new CVEs surface in
# already-released images (mostly via the base image), without any change in this repository.
name: Docker Scan

on:
  schedule:
    - cron: '30 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    # Do not run the scheduled scan in forks; manual runs are always allowed.
    if: github.event_name == 'workflow_dispatch' || github.repository == 'OpenIdentityPlatform/OpenAM'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7
      - name: Scan openidentityplatform/openam:latest (Trivy)
        # unlike the build.yml gate, unfixed CVEs are reported too: surfacing them in
        # the already-released image is the point of this workflow
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: openidentityplatform/openam:latest
          format: sarif
          output: trivy-latest.sarif
          severity: CRITICAL,HIGH
          limit-severities-for-sarif: true
          scanners: vuln
          cache: false
      - name: Upload report to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        # upload even if a preceding step failed, but not without a report to upload
        if: ${{ always() && hashFiles('trivy-latest.sarif') != '' }}
        with:
          sarif_file: trivy-latest.sarif
          category: trivy-image-latest