GH action: add SBOM + scanner for dockerfile and docker images

.github/trivy.yaml

@@ -0,0 +1,8 @@
+exit-code: 0
+severity: 'CRITICAL,HIGH'
+ignore-unfixed: true
+format: 'sarif'
+output: 'scan_dockerfile_result.sarif'
+misconfiguration:
+  file-patterns:
+    - "dockerfile:.*Dockerfile.releases.full"

.github/workflows/scan.yml

@@ -0,0 +1,31 @@
+name: Scan
+
+on:
+  pull_request:
+  push:
+    branches:
+      - '*'
+
+jobs:
+  scan:
+    name: Scan Dockerfile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          scan-type: 'config'
+          trivy-config: .github/trivy.yaml
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'scan_dockerfile_result.sarif'
+
+      - name: Archive scan results to GitHub
+        uses: actions/upload-artifact@v3
+        with:
+          name: trivyResult
+          path: 'scan_dockerfile_result.sarif'
+          if-no-files-found: error

.github/workflows/test-pr.yml

@@ -38,6 +38,11 @@ jobs:
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.os }}
     steps:
+      # - name: Enable WSL on Windows for sbom
+      #   if: runner.os == 'Windows'
+      #   uses: Vampire/setup-wsl@v1
+      #   with:
+      #     distribution: Alpine
       - uses: actions/checkout@v3
       - name: Prepare Environment
         run: ${{ matrix.runs.prepare }}
@@ -47,14 +52,35 @@ jobs:
         run: ${{ matrix.runs.build }}
       - name: Test ${{ matrix.name }}
         run: ${{ matrix.runs.test }}
-      - name: '"docker images"'
+      - name: 'List docker images'
         run: ${{ matrix.runs.images }}
+      - name: Scan Vulnerability on Linux(Windows support, soon)
+        if: runner.os == 'Linux'
+        id: scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ matrix.meta.entries[0].tags[0] }}'
+          format: 'sarif'
+          output: 'scan_dockerimage_result.sarif'
+          severity: 'CRITICAL,HIGH'
+      - name: Upload Trivy scan results to GitHub Security tab for Linux
+        if: steps.scan.conclusion == 'success'
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'scan_dockerimage_result.sarif'
+      - name: Generate SBOM for Linux
+        uses: anchore/sbom-action@v0
+        if: steps.scan.conclusion == 'success'
+        with:
+          image: '${{ matrix.meta.entries[0].tags[0] }}'
+          format: 'cyclonedx-json'
+          artifact-name: "SBOM_${{ matrix.name }}.json"
 
   conclusion:
     name: conclusion
     needs: test
     runs-on: ubuntu-latest
     if: always()
     steps:
-      - name: Result
+      - name: Check Test Result
         run: ${{ needs.test.result == 'success' }}