From f127c10a52880a61891e1a37c1f30ad98481c6fb Mon Sep 17 00:00:00 2001
From: Zoheb Shaikh <26975142+ZohebShaikh@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:53:00 +0100
Subject: [PATCH] add trivy and cargo audit

---
 .github/workflows/_trivy.yaml     | 35 +++++++++++++++++++++++++++++++
 .github/workflows/cargo_audit.yml | 20 ++++++++++++++++++
 .github/workflows/periodic.yml    | 18 ++++++++++++++++
 3 files changed, 73 insertions(+)
 create mode 100644 .github/workflows/_trivy.yaml
 create mode 100644 .github/workflows/cargo_audit.yml
 create mode 100644 .github/workflows/periodic.yml

diff --git a/.github/workflows/_trivy.yaml b/.github/workflows/_trivy.yaml
new file mode 100644
index 0000000..e18423b
--- /dev/null
+++ b/.github/workflows/_trivy.yaml
@@ -0,0 +1,35 @@
+name: Trivy vulnerability scan
+
+on:
+  workflow_call:
+
+jobs:
+  scan_container:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and export to Docker local cache
+        uses: docker/build-push-action@v7
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          context: .
+          load: true
+          tags: tag_for_scanning
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: 'tag_for_scanning'
+          version: 'v0.74.0'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
diff --git a/.github/workflows/cargo_audit.yml b/.github/workflows/cargo_audit.yml
new file mode 100644
index 0000000..34c2f45
--- /dev/null
+++ b/.github/workflows/cargo_audit.yml
@@ -0,0 +1,20 @@
+name: Cargo lock check
+
+on:
+  workflow_call:
+  push:
+    paths: 
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+
+jobs:
+  security_audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Audit Cargo.lock for security advisories
+        uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/periodic.yml b/.github/workflows/periodic.yml
new file mode 100644
index 0000000..a773eef
--- /dev/null
+++ b/.github/workflows/periodic.yml
@@ -0,0 +1,18 @@
+name: Periodic
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run weekly to check for new vulnerabilities
+    - cron: "0 8 * * WED"
+
+jobs:
+
+  trivy:
+    uses: ./.github/workflows/_trivy.yml
+
+  cargo_audit:
+    uses: ./.github/workflows/cargo_audit.yml
+    permissions:
+      issues: write
+      checks: write