From f3c8aec1895c5fb33d63e63be8be0821e8eab838 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Tue, 6 Jan 2026 17:50:57 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(ci)=20add=20trivy=20scans=20for=20?= =?UTF-8?q?summary=20and=20agent?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #685: add a Trivy scan to the CI build steps for Meet Summary and Meet Agents to ensure no vulnerabilities are present before pushing images to the registry. --- .github/workflows/docker-hub.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/docker-hub.yml b/.github/workflows/docker-hub.yml index 14c43b07..532233e5 100644 --- a/.github/workflows/docker-hub.yml +++ b/.github/workflows/docker-hub.yml @@ -147,6 +147,13 @@ jobs: with: username: ${{ secrets.DOCKER_HUB_USER }} password: ${{ secrets.DOCKER_HUB_PASSWORD }} + - + name: Run trivy scan + uses: numerique-gouv/action-trivy-cache@main + with: + docker-build-args: '-f src/summary/Dockerfile --target production' + docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-summary:${{ github.sha }}' + docker-context: './src/summary' - name: Build and push uses: docker/build-push-action@v6 @@ -178,6 +185,13 @@ jobs: with: username: ${{ secrets.DOCKER_HUB_USER }} password: ${{ secrets.DOCKER_HUB_PASSWORD }} + - + name: Run trivy scan + uses: numerique-gouv/action-trivy-cache@main + with: + docker-build-args: '-f src/agents/Dockerfile --target production' + docker-image-name: '${{ env.DOCKER_CONTAINER_REGISTRY_HOSTNAME }}/${{ env.DOCKER_CONTAINER_REGISTRY_NAMESPACE }}/meet-agents:${{ github.sha }}' + docker-context: './src/agents' - name: Build and push uses: docker/build-push-action@v6