[Copilot]

Adds a full Trivy image scan (OS packages + language libraries) to the test workflow, gated to push events on main so PR builds are unaffected.

Changes — .github/workflows/test.yml

• New docker-scan job:
  • Conditional: if: github.event_name == 'push' — skips entirely on pull requests
  • Job-level security-events: write permission for SARIF upload (not elevated workflow-wide)
  • Builds image locally via docker/build-push-action@v5 with load: true, tagged amazing-gitlab-exporter:scan
  • Runs aquasecurity/trivy-action@0.28.0 (scan-type: image, severity: CRITICAL,HIGH, ignore-unfixed: true, exit-code: 1)
  • Uploads trivy-image.sarif to GitHub Security tab via codeql-action/upload-sarif@v4 with if: always() so results surface even on scan failure

docker-scan:
  name: Docker Image Scan
  runs-on: ubuntu-latest
  if: github.event_name == 'push'
  permissions:
    contents: read
    security-events: write
  steps:
    - uses: docker/build-push-action@v5
      with:
        load: true
        tags: amazing-gitlab-exporter:scan
    - uses: aquasecurity/trivy-action@0.28.0
      with:
        scan-type: 'image'
        image-ref: 'amazing-gitlab-exporter:scan'
        severity: 'CRITICAL,HIGH'
        ignore-unfixed: true
        exit-code: '1'
        format: 'sarif'
        output: 'trivy-image.sarif'
    - uses: github/codeql-action/upload-sarif@v4
      if: always()
      with:
        sarif_file: 'trivy-image.sarif'

Existing helm-chart.yml config scan is untouched.

Original prompt

Add full Docker image vulnerability scanning with Trivy to the CI pipeline for pushes to protected branches.

Repository: tomer1983/amazing-gitlab-exporter
Base branch: main

Context:

• The repo already has GitHub Actions workflows:
  • .github/workflows/test.yml (runs on push/pull_request to main; includes a docker-build job that builds an image locally)
  • .github/workflows/helm-chart.yml (includes a security-scan job using Checkov and Trivy with scan-type: config)
  • .github/workflows/release.yml (builds and pushes docker images on tags)

Requested change:

• Implement "full docker scanning" using Trivy (image vulnerability scan: OS packages + language libraries).
• Run on each push to protected branches. Since GitHub Actions cannot dynamically detect protected branches, implement it for pushes to main (and optionally allow easy extension via a small list/pattern). Keep PR behavior unchanged unless necessary.

Implementation details:

1. Update .github/workflows/test.yml:

   • Add a new job (e.g., docker-scan) that runs only on push events (not on pull_request).
   • Ensure the job has permissions:
     • contents: read
     • security-events: write (needed for SARIF upload)
   • Build the Docker image locally for scanning. Prefer reusing the existing docker-build job outputs; simplest is to build again with docker/build-push-action using load: true and a local tag (e.g., amazing-gitlab-exporter:scan).
   • Run aquasecurity/trivy-action with:
     • scan-type: image
     • image-ref: amazing-gitlab-exporter:scan
     • format: sarif
     • output: trivy-image.sarif
     • ignore-unfixed: true
     • severity: CRITICAL,HIGH
     • exit-code: 1 (fail the job on findings)
   • Upload SARIF results using github/codeql-action/upload-sarif@v4.
   • Use if: always() for SARIF upload so results are uploaded even if scan fails.

2. Keep existing workflows intact (helm-chart config scan remains).

3. Ensure YAML is valid and consistent with existing versions in the repo (currently uses trivy-action@0.28.0 elsewhere and docker/build-push-action@v5 in test.yml).

Acceptance criteria:

• On push to main, workflow includes a Docker image vulnerability scan using Trivy.
• Findings of HIGH/CRITICAL (configurable via workflow inputs later, but hardcode is acceptable for now) fail the job.
• SARIF is uploaded to GitHub Security/code scanning.
• On pull_request events, Docker scan job does not run.

Files to change:

• .github/workflows/test.yml

This pull request was created from Copilot chat.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.