adx-mcp-server

name: Trivy Security Scan on: push: branches: [main] pull_request: branches: [main] # Schedule daily scan schedule: - cron: '0 0 * * *' jobs: scan-repo: name: Scan Repository for Vulnerabilities runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner in repo mode uses: aquasecurity/trivy-action@master with: scan-type: 'fs' ignore-unfixed: true format: 'sarif' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v2 if: always() with: sarif_file: 'trivy-results.sarif' scan-image: name: Scan Docker Image for Vulnerabilities runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Build Docker image run: docker build -t adx-mcp-server:${{ github.sha }} . - name: Run Trivy vulnerability scanner on Docker image uses: aquasecurity/trivy-action@master with: image-ref: 'adx-mcp-server:${{ github.sha }}' format: 'table' exit-code: '1' ignore-unfixed: true vuln-type: 'os,library' severity: 'CRITICAL,HIGH'