release-scan.yaml

name: 🔒 Security Scan

on:
  schedule:
    # Every Sunday at 00:00 UTC
    - cron: 0 0 * * 0
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      issues: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Environment
        uses: ./.github/actions/setup_environment
        with:
          with-python: "false"
          with-poetry: "false"

      - name: Get latest image tag
        id: get_tag
        uses: pozetroninc/github-action-get-latest-release@v0.8.0
        with:
          owner: ${{ github.repository_owner }}
          repo: ${{ github.event.repository.name }}
          excludes: prerelease, draft

      - name: Scan image for vulnerabilities
        id: scan
        uses: ovsds/run-with-output-action@v1
        continue-on-error: true
        with:
          run: |
            task backend:ci-image-scan \
              IMAGE_REGISTRY="ghcr.io/${{ github.repository_owner }}" \
              IMAGE_NAME="${{ github.event.repository.name }}" \
              IMAGE_TAG="${{ steps.get_tag.outputs.release }}"

      - name: Report vulnerabilities
        uses: ovsds/create-or-update-unique-issue-action@v1
        with:
          title: "Security scan issues for ${{ steps.get_tag.outputs.release }}"
          body: |
            ## Vulnerabilities found
            ```
            ${{ steps.scan.outputs.stdout }}
            ```
          unique-title-includes: "Security scan issues for "
          close: ${{ steps.scan.outputs.exit_code == 0 }}