mcp-toolz

name: Trivy Security Scan "on": push: branches: [main] pull_request: branches: [main] schedule: # Run every Monday at 7:00 UTC - cron: '0 7 * * 1' # Declare minimal permissions for all jobs permissions: read-all jobs: trivy: name: Trivy Vulnerability Scan runs-on: ubuntu-latest permissions: contents: read security-events: write steps: - name: Checkout Repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5 - name: Run Trivy vulnerability scanner in fs mode uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1 with: scan-type: 'fs' scan-ref: '.' format: 'sarif' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH,MEDIUM' # Scan Python dependencies scanners: 'vuln,secret,misconfig' - name: Upload Trivy results to GitHub Security tab uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4 if: always() with: sarif_file: 'trivy-results.sarif' category: 'trivy'