container security scan #662

	name: container security scan

	on:
	workflow_dispatch:
	inputs:
	tag:
	description: 'Container image tag'
	required: false
	default: 'develop'
	schedule:
	# Start of the hour is the busy time. Schedule it to run 8:17am UTC
	- cron: '17 8 * * *'

	jobs:
	scan-sarif:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write

	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	# Shell parameter expansion does not support directly on a step
	# Adding a separate step to set the image tag. This allows running
	# this workflow with a schedule as well as manual
	- name: Set image tag
	id: tag
	run: \|
	echo "TAG=${INPUT_TAG:-develop}" >> "$GITHUB_OUTPUT"
	env:
	INPUT_TAG: ${{ inputs.tag }}

	- name: Vulnerability scanner
	id: trivy
	uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
	with:
	image-ref: hyperledger/besu:${{ steps.tag.outputs.TAG }}
	format: sarif
	output: 'trivy-results.sarif'

	# Check the vulnerabilities via GitHub security tab
	- name: Upload results
	uses: github/codeql-action/upload-sarif@0e9f55954318745b37b7933c693bc093f7336125 # v4.35.1
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback