ZeroTrusted-ai PII Detection Agent

name: Trivy on: workflow_run: workflows: - Development types: - completed permissions: actions: read contents: read security-events: write jobs: vulnerability-scan: if: ${{ github.event.workflow_run.conclusion == 'success' }} runs-on: ubuntu-latest steps: - name: Remove unused packages run: | sudo rm -rf /usr/share/dotnet sudo rm -rf /opt/ghc sudo rm -rf /usr/local/lib/android sudo rm -rf "/usr/local/share/boost" sudo rm -rf "$AGENT_TOOLSDIRECTORY" sudo rm -rf /tmp/* sudo rm -rf /opt/hostedtoolcache/CodeQ sudo apt-get clean sudo rm -rf /var/lib/apt/lists/* sudo rm -rf /usr/local/share/powershell sudo rm -rf /usr/share/swift sudo rm -rf /usr/local/.ghcup - name: Checkout source code uses: actions/checkout@main - name: Get short SHA id: sha run: echo "short=$(echo ${{ github.event.workflow_run.head_sha }} | cut -c1-7)" >> $GITHUB_OUTPUT - name: Login to Azure Container Registry uses: azure/docker-login@master with: login-server: ${{ vars.REGISTRY_NAME }}.azurecr.io username: ${{ secrets.REGISTRY_USERNAME }} password: ${{ secrets.REGISTRY_PASSWORD }} - name: Pull image from ACR run: | docker pull ${{ vars.REGISTRY_NAME }}.azurecr.io/zt-pii-agent:dev-${{ steps.sha.outputs.short }} - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: image-ref: ${{ vars.REGISTRY_NAME }}.azurecr.io/zt-pii-agent:dev-${{ steps.sha.outputs.short }} scanners: vuln format: sarif output: trivy-results.sarif timeout: 30m0s - name: Upload scan results to GitHub uses: github/codeql-action/upload-sarif@main with: sarif_file: trivy-results.sarif