Skip to content

Commit 4f794cf

Browse files
chore(ci): add scheduled trivy scan with linear ticket creation
Weekly security scan (Monday 09:00 UTC) that scans the PyAtlan Docker image and uv.lock for HIGH/CRITICAL vulnerabilities and automatically creates a Linear ticket if issues are found. Uses the org's reusable workflow from atlanhq/.github. Requires: - LINEAR_API_KEY secret - LINEAR_TEAM_ID variable (team UUID from Linear) - CHAINGUARD_USERNAME/PASSWORD secrets (for registry auth)
1 parent d4d4f1a commit 4f794cf

1 file changed

Lines changed: 26 additions & 0 deletions

File tree

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: PyAtlan Scheduled Security Scan
2+
3+
on:
4+
schedule:
5+
# Every Monday at 09:00 UTC
6+
- cron: '0 9 * * 1'
7+
workflow_dispatch: # Allow manual trigger
8+
9+
jobs:
10+
scan:
11+
uses: atlanhq/.github/.github/workflows/reusable-trivy-scan-scheduled.yml@main
12+
with:
13+
image_context: '.'
14+
dockerfile: './Dockerfile'
15+
image_tag: 'pyatlan-scheduled-scan:latest'
16+
scan_uv_lock: true
17+
uv_lock_path: 'uv.lock'
18+
service_name: 'PyAtlan'
19+
linear_team_id: ${{ vars.LINEAR_TEAM_ID }}
20+
linear_priority: 2
21+
registry_login: true
22+
registry_url: 'cgr.dev'
23+
secrets:
24+
LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
25+
REGISTRY_USERNAME: ${{ secrets.CHAINGUARD_USERNAME }}
26+
REGISTRY_PASSWORD: ${{ secrets.CHAINGUARD_PASSWORD }}

0 commit comments

Comments
 (0)