Trivy: Publish an official GitHub Action for Trivy

[jonpulsifer]

Hi friends! I was looking to add Trivy to my CI pipelines and noticed there was no official GitHub Action published by Aqua.

@homoluctus (:wave: hi!) has built something that looks like what I want over at https://github.com/homoluctus/gitrivy, but the project is not under active development (as far as I can tell, given the open issues).

@knqyf263 have you thought about this? Is this something we can provide the community?

Ref https://github.com/aquasecurity/trivy/issues/233 I know we can DIY, but would like someone else to own it.

[sylus]

I also know there is this if helps:

https://github.com/Azure/container-scan

[jonpulsifer]

@sylus thanks for the tip, it certainly does 😄

Ref https://github.com/Azure/container-scan/issues/21#issuecomment-629745478

It's remarkable to me that container-scan is so new such that it does not work out of the box, and neither MicroGitHubSoft nor Aqua have one of these ready to go.

[knqyf263]

@jonpulsifer Thank you for filing the issue. It sounds a nice idea.

[jerbia]

@simar7 do we now have an official Aqua Trivy github action?

[simar7]

@simar7 do we now have an official Aqua Trivy github action?

Yes. It's available here: https://github.com/aquasecurity/trivy-action