kestra/.github/workflows/vulnerabilities-check.yml

name: Vulnerabilities Checks

on:
  schedule:
    - cron: "0 0 * * *"  # Every day
  workflow_dispatch: {}

env:
  JAVA_VERSION: '21'

jobs:
  dependency-check:
    name: Dependency Check
    runs-on: ubuntu-latest
    steps:
      # Checkout
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Checkout GitHub Actions
      - uses: actions/checkout@v4
        with:
          repository: kestra-io/actions
          path: actions
          ref: main

      # Setup build
      - uses: ./actions/.github/actions/setup-build
        id: build
        with:
          java-enabled: true
          node-enabled: true
          caches-enabled: true

      # Run OWASP dependency check plugin
      - name: Gradle Dependency Check
        run: |
          ./gradlew dependencyCheckAggregate

        # Upload dependency check report
      - name: Upload dependency check report
        uses: actions/upload-artifact@v4
        if: ${{ always() }}
        with:
          name: dependency-check-report
          path: build/reports/dependency-check-report.html

  develop-image-check:
    name: Image Check (develop)
    runs-on: ubuntu-latest
    steps:
      # Checkout
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Checkout GitHub Actions
      - uses: actions/checkout@v4
        with:
          repository: kestra-io/actions
          path: actions
          ref: main

      # Setup build
      - uses: ./actions/.github/actions/setup-build
        id: build
        with:
          java-enabled: false
          node-enabled: false
          caches-enabled: true

      # Run Trivy image scan for Docker vulnerabilities, see https://github.com/aquasecurity/trivy-action
      - name: Docker Vulnerabilities Check
        uses: aquasecurity/trivy-action@0.24.0
        with:
          image-ref: kestra/kestra:develop
          format: table
          skip-dirs: /app/plugins
          scanners: vuln

  latest-image-check:
    name: Image Check (latest)
    runs-on: ubuntu-latest
    steps:
      # Checkout
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Checkout GitHub Actions
      - uses: actions/checkout@v4
        with:
          repository: kestra-io/actions
          path: actions
          ref: main

      # Setup build
      - uses: ./actions/.github/actions/setup-build
        id: build
        with:
          java-enabled: false
          node-enabled: false
          caches-enabled: true

      # Run Trivy image scan for Docker vulnerabilities, see https://github.com/aquasecurity/trivy-action
      - name: Docker Vulnerabilities Check
        uses: aquasecurity/trivy-action@0.24.0
        with:
          image-ref: kestra/kestra:latest
          format: table
          skip-dirs: /app/plugins
          scanners: vuln