From 1a82b379a93067e02a7eeed2de37d2893350f54b Mon Sep 17 00:00:00 2001
From: Manuel Raynaud <manu@raynaud.io>
Date: Tue, 12 May 2026 09:00:15 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(ci)=20enable=20trivy=20step?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to enable again the trivy step. This step can be enabled using
an action variable.
---
 .github/workflows/docker-publish.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 01bb82d48..0a9f371dd 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -89,8 +89,17 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_HUB_USER }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+      - name: Run trivy scan
+        if: ${{ vars.TRIVY_SCAN_ENABLED == 'true' }}
+        uses: numerique-gouv/action-trivy-cache@main
+        env:
+          DOCKER_USER: ${{ inputs.docker_user }}
+        with:
+          docker-build-args: "--target ${{ inputs.target }} -f ${{ inputs.file }}"
+          docker-image-name: "docker.io/${{ inputs.image_name }}:${{ github.sha }}"
+          trivyignores: ./.github/.trivyignore
       - name: Build and push (amd64)
-        if: ${{ inputs.should_push }}||${{ vars.TRIVY_SCAN_ENABLED }} != 'true'
+        if: ${{ inputs.should_push || vars.TRIVY_SCAN_ENABLED != 'true' }}
         uses: docker/build-push-action@v6
         with:
           context: ${{ inputs.context }}