container-scan.yml

name: Container Scan

# Trivy container image scanning for OS and application dependency CVEs.
# Runs on every build for audit evidence (artifact). Remediation is handled
# separately by the container-remediation.yml scheduled workflow.

on:
  workflow_call:
    inputs:
      image-ref:
        description: Container image to scan (e.g. 613957054632.dkr.ecr.us-east-1.amazonaws.com/kernel/api:sha-abc1234)
        type: string
        required: true
      severity:
        description: Comma-separated severities to flag (CRITICAL,HIGH,MEDIUM,LOW)
        type: string
        required: false
        default: 'CRITICAL,HIGH'
      exit-code:
        description: Exit code when vulnerabilities are found (1 to fail the build, 0 to observe only)
        type: string
        required: false
        default: '0'
      ignore-unfixed:
        description: Skip CVEs with no available patch
        type: boolean
        required: false
        default: true
      aws-region:
        description: AWS region for ECR login
        type: string
        required: false
        default: 'us-east-1'
      ecr-role-to-assume:
        description: IAM role ARN to assume for ECR pull access
        type: string
        required: false
        default: ''

jobs:
  scan:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        if: inputs.ecr-role-to-assume != ''
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ inputs.ecr-role-to-assume }}
          aws-region: ${{ inputs.aws-region }}

      - name: Log in to ECR
        if: inputs.ecr-role-to-assume != ''
        uses: aws-actions/amazon-ecr-login@v2

      - name: Scan container image (table)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ inputs.image-ref }}
          severity: ${{ inputs.severity }}
          exit-code: '0'
          ignore-unfixed: ${{ inputs.ignore-unfixed }}
          format: 'table'

      - name: Scan container image (json)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ inputs.image-ref }}
          severity: ${{ inputs.severity }}
          exit-code: ${{ inputs.exit-code }}
          ignore-unfixed: ${{ inputs.ignore-unfixed }}
          format: 'json'
          output: 'trivy-results.json'

      - name: Write scan summary
        if: always()
        shell: bash
        run: |
          if [ ! -f trivy-results.json ]; then
            echo "No scan results produced." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' trivy-results.json)
          HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length' trivy-results.json)
          MEDIUM=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "MEDIUM")] | length' trivy-results.json)
          LOW=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "LOW")] | length' trivy-results.json)
          {
            echo "### Container Scan Results"
            echo "**Image:** \`${{ inputs.image-ref }}\`"
            echo ""
            echo "| Severity | Count |"
            echo "|----------|-------|"
            echo "| Critical | $CRITICAL |"
            echo "| High | $HIGH |"
            echo "| Medium | $MEDIUM |"
            echo "| Low | $LOW |"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload scan artifact
        uses: actions/upload-artifact@v4
        with:
          name: container-scan-report
          path: trivy-results.json
        if: always()