reusable-vulnerability-scan.yml

name: Vulnerability Scan (reusable)
on:
  workflow_call:
    inputs:
      tag:
        description: "Docker image tag to scan"
        required: true
        type: string

jobs:
  scan_batfish:
    runs-on: ubuntu-latest
    steps:
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: "batfish/batfish:${{ inputs.tag }}"
          format: "table"
          exit-code: "1"
          ignore-unfixed: true
          severity: "MEDIUM,HIGH,CRITICAL"
  scan_allinone:
    runs-on: ubuntu-latest
    steps:
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: "batfish/allinone:${{ inputs.tag }}"
          format: "table"
          exit-code: "1"
          ignore-unfixed: true
          severity: "MEDIUM,HIGH,CRITICAL"