From 5423bccd5667d24db6a26aa448cefc722d11b052 Mon Sep 17 00:00:00 2001
From: Chris Bono <cbono@vmware.com>
Date: Mon, 11 Dec 2023 23:42:49 -0600
Subject: [PATCH] [CI] Fix Trivy scan in both CI and CI PR workflows (take2)

---
 .github/workflows/ci.yml         |  7 ++-----
 .github/workflows/trivy-scan.yml | 16 +++++++++++++++-
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 284c72b3..ff0c4c2a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,7 @@ env:
   ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
 
+jobs:
   prerequisites:
     name: Pre-requisites for building
     runs-on: ubuntu-latest
@@ -88,11 +89,7 @@ env:
     uses: ./.github/workflows/trivy-scan.yml
     with:
       config-path: .github/trivy-to-sarif.yaml
-  upload_scan_to_github:
-    needs: [scan]
-    uses: github/codeql-action/upload-sarif@v2
-    with:
-      sarif_file: 'trivy-results.sarif'
+      upload-results: true
   deploy_artifacts:
     name: Deploy Artifacts
     needs: [build_jdk_17, check_samples, scan]
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index b9468b62..af303377 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -8,7 +8,11 @@ on:
         default: '.github/trivy-to-console.yaml'
         required: false
         type: string
-
+      upload-results:
+        description: 'Upload scan results to Github?'
+        default: false
+        required: false
+        type: boolean
   workflow_call:
     inputs:
       config-path:
@@ -16,6 +20,11 @@ on:
         default: '.github/trivy-to-console.yaml'
         required: false
         type: string
+      upload-results:
+        description: 'Upload scan results to Github?'
+        default: false
+        required: false
+        type: boolean
 
 jobs:
   run_trivy_scan:
@@ -35,3 +44,8 @@ jobs:
           scan-type: 'fs'
           scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
           trivy-config: ${{ inputs.config-path }}
+      - name: Upload Trivy scan results to GitHub Security tab
+        if: inputs.upload-results
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'