PR from cicd-patch to main for commit 664a685

.github/workflows/pr-check.yml

@@ -17,6 +17,9 @@ env:
   LINT_REPORT_FILE: "lint-report"
   PY_VER: 3.11.8
   PR_CHECK_PREFIX: "feat:|fix:|devops:|Merge|Revert|build\\(deps\\)|\\[Snyk\\]|Bump"
+  GH_SEC_REPORT: false
+  TRIVY_SEVERITY: "HIGH,CRITICAL"
+  TRIVY_REPORT_FILE: "trivy-scan-result"
 
 jobs:
   javelin-commit-check:
@@ -76,4 +79,70 @@ jobs:
         with:
           name: ${{ env.LINT_REPORT_FILE }}
           path: ${{ env.LINT_REPORT_FILE }}.json
-          retention-days: 1
+          retention-days: 1
+
+  javelin-trivy-scan:
+    permissions:
+      contents: 'read'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: true
+
+      - name: Trivy Scan - GitHub Security Report
+        if: ${{ env.GH_SEC_REPORT == 'true' }}
+        uses: aquasecurity/trivy-action@0.29.0
+        with:
+          ignore-unfixed: true
+          scan-type: "fs"
+          cache: "true"
+          format: "sarif"
+          output: "${{ env.TRIVY_REPORT_FILE }}.sarif"
+          severity: "${{ env.TRIVY_SEVERITY }}"
+
+      - name: Upload Report - GitHub Security Report
+        if: ${{ env.GH_SEC_REPORT == 'true' }}
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "${{ env.TRIVY_REPORT_FILE }}.sarif"
+
+      - name: Trivy Scan - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' }}
+        uses: aquasecurity/trivy-action@0.29.0
+        with:
+          ignore-unfixed: true
+          scan-type: "fs"
+          cache: "true"
+          format: "table"
+          output: "${{ env.TRIVY_REPORT_FILE }}.txt"
+          severity: "${{ env.TRIVY_SEVERITY }}"
+
+      - name: Report Check - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' }}
+        id: report_check
+        shell: bash
+        run: |-
+          if [[ -s ${{ env.TRIVY_REPORT_FILE }}.txt ]] ; then
+            echo "report_file=available" >> ${GITHUB_OUTPUT}
+          else
+            echo "report_file=unavailable" >> ${GITHUB_OUTPUT}
+          fi
+          cat ${{ env.TRIVY_REPORT_FILE }}.txt
+
+      - name: Upload Report - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' && steps.report_check.outputs.report_file  == 'available' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: "${{ env.TRIVY_REPORT_FILE }}"
+          path: "${{ env.TRIVY_REPORT_FILE }}.txt"
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Failing the Job
+        if: ${{ steps.report_check.outputs.report_file  == 'available' }}
+        shell: bash
+        run: |-
+          echo "Vulnerabilities Found.....!"
+          exit 1