Prometheus MCP Server

name: trivy on: push: branches: [ "main" ] pull_request: # The branches below must be a subset of the branches above branches: [ "main" ] schedule: - cron: '36 8 * * 3' permissions: contents: read jobs: # Security scan with failure on CRITICAL vulnerabilities security-scan: permissions: contents: read security-events: write actions: read name: Security Scan runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Build Docker image for scanning run: | docker build -t ghcr.io/pab1it0/prometheus-mcp-server:${{ github.sha }} . - name: Run Trivy vulnerability scanner (fail on CRITICAL Python packages only) uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe with: image-ref: 'ghcr.io/pab1it0/prometheus-mcp-server:${{ github.sha }}' format: 'table' severity: 'CRITICAL' exit-code: '1' scanners: 'vuln' vuln-type: 'library' - name: Run Trivy vulnerability scanner (SARIF output) uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe if: always() with: image-ref: 'ghcr.io/pab1it0/prometheus-mcp-server:${{ github.sha }}' format: 'template' template: '@/contrib/sarif.tpl' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH,MEDIUM' - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: 'trivy-results.sarif' # Additional filesystem scan for source code vulnerabilities filesystem-scan: permissions: contents: read security-events: write name: Filesystem Security Scan runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Run Trivy filesystem scanner uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe with: scan-type: 'fs' scan-ref: '.' format: 'template' template: '@/contrib/sarif.tpl' output: 'trivy-fs-results.sarif' severity: 'CRITICAL,HIGH' - name: Upload filesystem scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: 'trivy-fs-results.sarif'