code_scan.yml

name: Code Scanning
permissions: read-all

on:
  workflow_dispatch: # run on request (no need for PR)
  schedule:
    # every UTC 6PM from Mon to Fri
    - cron: "0 18 * * 1-5"

jobs:
  Bandit:
    runs-on: ubuntu-20.04
    steps:
      - name: CHECKOUT REPOSITORY
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: python -m pip install tox
      - name: Bandit Scanning
        run: tox -e bandit-scan
      - name: UPLOAD BANDIT REPORT
        uses: actions/upload-artifact@v4
        with:
          name: bandit-report
          path: .tox/bandit-report.txt
        # Use always() to always run this step to publish scan results when there are test failures
        if: ${{ always() }}
  Trivy-scan:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: python -m pip install tox
      - name: Trivy Scanning
        env:
          TRIVY_DOWNLOAD_URL: ${{ vars.TRIVY_DOWNLOAD_URL }}
        run: tox -vv -e trivy-scan
      - name: Upload Trivy results artifact
        uses: actions/upload-artifact@v4
        with:
          name: trivy-results
          path: |
            .tox/trivy-scan-results.txt
            .tox/trivy-spdx-anomalib.json