Merge branch 'main' into dependabot-github_actions-azure-setup-helm-4

.github/workflows/trivy-gradle.yml

@@ -0,0 +1,76 @@
+name: 'Trivy Scan Docker and Repository'
+on:
+  workflow_call:
+    inputs:
+      javaVersion:
+        required: false
+        type: string
+        default: '17'
+      buildCommand:
+        required: false
+        type: string
+      sarif:
+        required: false
+        description: 'Whether to generate a sarif report, otherwise a table is generated.'
+        type: string
+        default: 'false'
+      severity:
+        required: true
+        description: 'The severity of the vulnerabilities to report.'
+        type: string
+        default: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
+      checkoutSubmodule:
+        required: false
+        description: 'Whether to checkout submodules.'
+        type: string
+        default: 'true'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  image:
+    name: 'Trivy Image Scan'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: ${{ inputs.checkoutSubmodule }}
+
+        - name: Build project
+          uses: UKHomeOffice/sas-github-workflows/.github/actions/gradle-build-project@v2
+          with:
+            java_version: ${{ inputs.javaVersion }}
+            build_command: ${{ inputs.buildCommand }}
+            github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Scan image
+        uses: UKHomeOffice/sas-github-workflows/.github/actions/trivy-image-scan@v2
+        with: 
+          sarif: ${{ inputs.sarif }}
+          severity: ${{ inputs.severity }}
+
+  repo:
+    name: 'Trivy Repo Scan'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: ${{ inputs.checkoutSubmodule }}
+
+      - name: Scan repository 
+        uses: UKHomeOffice/sas-github-workflows/.github/actions/trivy-repo-scan@v2
+        with:
+          sarif: ${{ inputs.sarif }}
+          severity: ${{ inputs.severity }}