Automated Container Vulnerability Pipeline

An automated supply-chain security pipeline that embeds vulnerability scanning and software bill of materials (SBOM) generation directly into GitHub Actions.

Pipeline Architecture

1. Static Analysis: Source code linting and secret scanning with Gitleaks.
2. Container Build: Multi-stage Docker build targeting minimal Alpine / distroless bases.
3. Vulnerability Audit: Trivy image scanning checking for operating system and application library flaws.
4. Image Signing: Cosign keyless signing verifying build origin before registry push.

name: Security Audit & Sign
on: [push, pull_request]

jobs:
  trivy-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan Image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'