security.yml

name: security-scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  trivy-fs:
    name: Trivy File System Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Trivy
        uses: aquasecurity/setup-trivy@v0.2.2

      - name: Scan repository (FS)
        run: trivy fs --exit-code 1 --severity HIGH,CRITICAL .

  trivy-image:
    name: Trivy Docker Image Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image
        run: |
          docker build -t systemzero:ci -f Dockerfile .

      - name: Install Trivy
        uses: aquasecurity/setup-trivy@v0.2.2

      - name: Scan Docker image
        run: trivy image --exit-code 1 --severity HIGH,CRITICAL systemzero:ci