1616permissions :
1717 id-token : write # This is required for requesting the JWT
1818 contents : read # This is required for actions/checkout
19+ pull-requests : read
1920 security-events : write
2021
2122# A workflow run is made up of one or more jobs that can run sequentially or in parallel
@@ -30,10 +31,36 @@ jobs:
3031 - name : Git Checkout
3132 uses : actions/checkout@v4.1.7
3233
34+ - name : Get changed files
35+ id : changed-files
36+ uses : tj-actions/changed-files@v44.5.7
37+ with :
38+ files_ignore : |
39+ .github/**
40+ .dockerignore
41+ .env
42+ .env.example
43+ .gitattributes
44+ .gitignore
45+ config.json
46+ config.json.example
47+ **.md
48+ LICENSE
49+
50+ - name : List all changed files
51+ env :
52+ ALL_CHANGED_FILES : ${{ steps.changed-files.outputs.all_changed_files }}
53+ run : |
54+ for file in ${ALL_CHANGED_FILES}; do
55+ echo "$file was changed"
56+ done
57+
3358 - name : Set up Docker Buildx
59+ if : steps.changed-files.outputs.any_changed == 'true'
3460 uses : docker/setup-buildx-action@v3
3561
3662 - name : Build Docker image
63+ if : steps.changed-files.outputs.any_changed == 'true'
3764 uses : docker/build-push-action@v6.6.1
3865 with :
3966 context : .
4370 tags : georgedavisibexlabs/publish-sarif-to-jira:build
4471
4572 - name : Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
73+ if : steps.changed-files.outputs.any_changed == 'true'
4674 uses : aquasecurity/trivy-action@0.24.0
4775 with :
4876 scan-type : ' fs'
@@ -52,16 +80,19 @@ jobs:
5280 github-pat : ${{ secrets.GITHUB_TOKEN }}
5381
5482 - name : Upload trivy SBOM as a Github artifact
83+ if : steps.changed-files.outputs.any_changed == 'true'
5584 uses : actions/upload-artifact@v4.3.6
5685 with :
5786 name : trivy-sbom-report
5887 path : trivy-dependency-results.sbom.json
5988 retention-days : 30
6089
6190 - name : List Docker Containers
91+ if : steps.changed-files.outputs.any_changed == 'true'
6292 run : ' docker ps -a'
6393
6494 - name : List Docker Images
95+ if : steps.changed-files.outputs.any_changed == 'true'
6596 run : ' docker images'
6697
6798 # - name: Run Trivy Image scanner
0 commit comments