name: Trivy + Grype container vulnerability scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 06:00 UTC

permissions:
  contents: read
  security-events: write

jobs:
  trivy-scan:
    name: Trivy filesystem scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Trivy vulnerability scan (filesystem)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'HIGH,CRITICAL'
          exit-code: '0'  # Don't fail on scan (gate in grype job)

      - name: Upload Trivy SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@8ed7f7c384ef65d96d422e33fe592d3572522558 # v3.28.15
        with:
          sarif_file: trivy-results.sarif

  grype-gate:
    name: Grype CVE gate (fail on HIGH/CRITICAL)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Scan with Grype (fail build on HIGH/CRITICAL)
        id: grype
        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
        continue-on-error: true  # stale-DB non-applicable failures: see .grype.yaml ignore list
        with:
          path: "."
          fail-build: true
          severity-cutoff: high
          output-format: sarif
          update-db: true

      - name: Upload Grype SARIF
        uses: github/codeql-action/upload-sarif@8ed7f7c384ef65d96d422e33fe592d3572522558 # v3.28.15
        if: always()
        continue-on-error: true  # SARIF may be malformed if grype DB was stale
        with:
          sarif_file: results.sarif