name: Trivy Vulnerability Scan
on: [push]
jobs:
  trivy:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'json'
          output: 'trivy-results.json'
          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
          exit-code: '0'
      - name: Upload results to DefectDojo
        run: |
          curl -s -X POST "${{ secrets.DEFECTDOJO_URL }}/api/v2/import-scan/" \
            -H "Authorization: Token ${{ secrets.DEFECTDOJO_API_KEY }}" \
            -F "scan_type=Trivy Scan" \
            -F "file=@trivy-results.json" \
            -F "product_name=${{ github.repository }}" \
            -F "engagement_name=CI Scans" \
            -F "auto_create_context=true" \
            -F "active=true" \
            -F "verified=false" \
            -F "minimum_severity=Low"