Security #1172

	---
	name: Security

	# yamllint disable-line rule:truthy
	on:
	workflow_dispatch:
	schedule:
	- cron: "42 05 * * *"

	concurrency:
	group: ${{ github.workflow }}
	cancel-in-progress: false

	permissions:
	contents: read

	jobs:
	container:
	if: github.repository_owner == 'searxng'
	name: Container
	runs-on: ubuntu-24.04-arm
	permissions:
	security-events: write

	steps:
	- name: Checkout
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
	with:
	persist-credentials: "false"

	- name: Sync GHCS from Docker Scout
	uses: docker/scout-action@f8c776824083494ab0d56b8105ba2ca85c86e4de # v1.18.2
	with:
	organization: "searxng"
	dockerhub-user: "${{ secrets.DOCKERHUB_USERNAME }}"
	dockerhub-password: "${{ secrets.DOCKERHUB_TOKEN }}"
	image: "registry://ghcr.io/searxng/searxng:latest"
	command: "cves"
	sarif-file: "./scout.sarif"
	exit-code: "false"
	write-comment: "false"

	- name: Upload SARIFs
	uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
	with:
	sarif_file: "./scout.sarif"

Provide feedback