name: Trivy Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  scan-image:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - name: bentopdf
            file: Dockerfile
          - name: bentopdf-nonroot
            file: Dockerfile.nonroot
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Build image for scanning
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: .
          file: ${{ matrix.image.file }}
          push: false
          load: true
          tags: ${{ matrix.image.name }}:scan
          no-cache: true

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ matrix.image.name }}:scan
          format: sarif
          output: trivy-${{ matrix.image.name }}.sarif
          severity: CRITICAL,HIGH
          exit-code: '1'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('trivy-*.sarif') != ''
        with:
          sarif_file: trivy-${{ matrix.image.name }}.sarif
          category: trivy-${{ matrix.image.name }}

  scan-dependencies:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Scan npm dependencies with Trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-deps.sarif
          severity: CRITICAL,HIGH
          scanners: vuln

      - name: Upload dependency scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('trivy-deps.sarif') != ''
        with:
          sarif_file: trivy-deps.sarif
          category: trivy-dependencies

  scan-config:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Scan Dockerfiles for misconfigurations
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: config
          scan-ref: .
          format: sarif
          output: trivy-config.sarif
          severity: CRITICAL,HIGH

      - name: Upload config scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('trivy-config.sarif') != ''
        with:
          sarif_file: trivy-config.sarif
          category: trivy-config