add org template for trivy scan

Author: hjha-nr

.github/workflows/org-level-trivy-scan.yml

@@ -0,0 +1,115 @@
+name: 'Organization Vulnerability Scan'
+
+on:
+  workflow_call:
+    inputs:
+      image-name:
+        description: 'The full name of the Docker image to scan'
+        required: true
+        type: string
+    secrets:
+      TEAM_SLACK_WEBHOOK_URL:
+        description: 'Slack webhook for team-specific vulnerability alerts'
+        required: false
+
+jobs:
+  vulnerability-scan:
+    name: Trivy Vulnerability Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+      security-events: write
+
+    env:
+      SLACK_WEBHOOK_URL_SET: ${{ secrets.TEAM_SLACK_WEBHOOK_URL != '' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Trivy for console output (All Vulnerabilities)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ inputs.image-name }}
+          scan-type: 'image'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+          ignore-unfixed: false
+          format: 'table'
+          exit-code: '0'
+
+      - name: Run Trivy for console output (All Vulnerabilities) unfixed
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ inputs.image-name }}
+          scan-type: 'image'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+          ignore-unfixed: true
+          format: 'table'
+          exit-code: '0'
+
+      - name: Run Trivy for SARIF report (Fixed Vulnerabilities Only)
+        id: trivy_sarif_scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ inputs.image-name }}
+          scan-type: 'image'
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: '1'
+        continue-on-error: true
+
+      # Check if the SARIF file has content 
+      - name: Check if SARIF report has content
+        id: check_sarif
+        run: |
+          # If the trivy-results.sarif file exists and is larger than a few bytes (i.e., not empty),
+          # set the output 'sarif_has_content' to true.
+          if [ -s trivy-results.sarif ] && [ $(wc -c < trivy-results.sarif) -gt 2 ]; then
+            echo "sarif_has_content=true" >> $GITHUB_OUTPUT
+          else
+            echo "sarif_has_content=false" >> $GITHUB_OUTPUT
+          fi
+        if: always() # Ensure this check runs even if the previous step failed
+
+      # Upload on condition
+      - name: Upload Trivy SARIF report to GitHub Security
+        # checks the output if ignore-unfixed is true throws an output
+        if: steps.check_sarif.outputs.sarif_has_content == 'true'
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'
+
+      - name: Send Slack Notification on Failure
+        if: steps.trivy_sarif_scan.outcome == 'failure' && env.SLACK_WEBHOOK_URL_SET == 'true'
+        uses: slackapi/[email protected]
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": { "type": "mrkdwn", "text": "🚨 *Vulnerability Alert in `${{ github.repository }}`*" }
+                },
+                {
+                  "type": "section",
+                  "text": { "type": "mrkdwn", "text": "High or critical vulnerabilities with an available fix were detected." }
+                },
+                {
+                  "type": "actions",
+                  "elements": [ { "type": "button", "text": { "type": "plain_text", "text": "View Workflow Run" }, "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" } ]
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.TEAM_SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK