vulnerability_check.yml

name: Container Scan
on:
  # Trigger the workflow on push or pull request,
  # but only for the master branch
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Build and load CKAN
        uses: docker/build-push-action@v4
        with:
          context: ./ckan
          load: true
          tags: ckan-docker/ckan:latest
      - name: Build and load CKAN xloader
        uses: docker/build-push-action@v4
        with:
          context: ./ckan/ckanext-xloader
          load: true
          tags: ckan-docker/ckan:latest
      - name: Scan for vulnerabilities for CKAN image
        uses: crazy-max/ghaction-container-scan@v3
        with:
          image: ckan-docker/ckan:latest
          dockerfile: ./ckan/Dockerfile
      - name: Scan for vulnerabilities for CKAN xloader image
        uses: crazy-max/ghaction-container-scan@v3
        with:
          image: ckan-docker/ckan-xloader:latest
          dockerfile: ./ckan/ckanext-xloader/Dockerfile