From 6fa18e7afaf62cdc1df39f973158797c4f86ecfc Mon Sep 17 00:00:00 2001
From: Zoheb Shaikh <26975142+ZohebShaikh@users.noreply.github.com>
Date: Sat, 31 Oct 2026 22:31:16 +0000
Subject: [PATCH] Add Trivy container image scan

Copies blueapi's _trivy.yml, runs it in CI and weekly via periodic.yml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/_trivy.yml   | 34 ++++++++++++++++++++++++++++++++++
 .github/workflows/ci.yml       |  3 +++
 .github/workflows/periodic.yml | 10 ++++++++++
 3 files changed, 47 insertions(+)
 create mode 100644 .github/workflows/_trivy.yml
 create mode 100644 .github/workflows/periodic.yml

diff --git a/.github/workflows/_trivy.yml b/.github/workflows/_trivy.yml
new file mode 100644
index 0000000..36af54e
--- /dev/null
+++ b/.github/workflows/_trivy.yml
@@ -0,0 +1,34 @@
+name: Trivy vulnerability scan
+
+on:
+  workflow_call:
+
+jobs:
+  scan_container:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and export to Docker local cache
+        uses: docker/build-push-action@v7
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          context: .
+          load: true
+          tags: tag_for_scanning
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "tag_for_scanning"
+          version: "latest"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a85871b..4b7a937 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,6 +51,9 @@ jobs:
       contents: read
       packages: write
 
+  trivy:
+    uses: ./.github/workflows/_trivy.yml
+
   helm:
     # The chart's default image is the one container pushes for the same tag
     needs: [test, container]
diff --git a/.github/workflows/periodic.yml b/.github/workflows/periodic.yml
new file mode 100644
index 0000000..a38549c
--- /dev/null
+++ b/.github/workflows/periodic.yml
@@ -0,0 +1,10 @@
+name: Periodic
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 8 * * WED"
+
+jobs:
+  trivy:
+    uses: ./.github/workflows/_trivy.yml