From b67326e12e57d2bd02053dd85f224c1fc1934f0e Mon Sep 17 00:00:00 2001
From: Chris Bono <cbono@vmware.com>
Date: Mon, 11 Dec 2023 00:28:04 -0600
Subject: [PATCH] [CI] Fix trivy standalone workflow

---
 .github/trivy.yaml               | 19 ++++++++++++++++++
 .github/workflows/trivy-scan.yml | 34 ++++++++++++++++++--------------
 trivy.yaml                       |  4 ----
 3 files changed, 38 insertions(+), 19 deletions(-)
 create mode 100644 .github/trivy.yaml
 delete mode 100644 trivy.yaml

diff --git a/.github/trivy.yaml b/.github/trivy.yaml
new file mode 100644
index 00000000..5e79f363
--- /dev/null
+++ b/.github/trivy.yaml
@@ -0,0 +1,19 @@
+scan:
+  scanners:
+    - vuln
+  file-patterns:
+    - 'pom:.*\.pom'
+
+severity:
+  - CRITICAL
+  - HIGH
+
+vulnerability:
+  ignore-unfixed: true
+
+# format: json
+# output: trivy-results.json
+
+exit-code: 1
+timeout: 10m
+debug: false
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index cd87516d..da3e45c6 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -7,26 +7,30 @@ jobs:
   run_trivy_scan:
     name: Run Trivy Scan
     runs-on: ubuntu-latest
-    if: github.repository == 'spring-projects/spring-pulsar'
+    env:
+      LOCAL_REPOSITORY_PATH: ./build/publications/repos
     steps:
       - uses: actions/checkout@v3
       - uses: spring-io/spring-gradle-build-action@v2
-      - name: Build
+      - name: Publish to local repo (poms)
         run: |
-          ./gradlew clean build -x integrationTest -x test
+          ./gradlew publishMavenJavaPublicationToLocalRepository
       - name: Run Trivy scan in repo mode
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: 'fs'
-          ignore-unfixed: true
-          format: 'table'
-          output: 'trivy-results.txt'
-          severity: 'CRITICAL,HIGH'
-          exit-code: 1
-      - name: Upload Trivy scan results
-        if: failure()
-        uses: actions/upload-artifact@v3
-        with:
-          name: trivy-results
-          path: 'trivy-results.txt'
-          retention-days: 3
+          scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
+          trivy-config: .github/trivy.yaml
+
+      # - name: Output Trivy scan results
+      #   if: always()
+      #   run: |
+      #     cat trivy-results.json
+
+      # - name: Upload Trivy scan results
+      #   uses: actions/upload-artifact@v3
+      #   if: always()
+      #   with:
+      #     name: trivy-results
+      #     path: trivy-results.json
+      #     retention-days: 3
diff --git a/trivy.yaml b/trivy.yaml
deleted file mode 100644
index 5b02ae46..00000000
--- a/trivy.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-timeout: 10m
-scan:
-  security-checks:
-    - vuln