scan.yml

name: Periodic Security Scan
# Periodically scan production images for security vulnerabilities
on:
  schedule:
    # Once a day at midnight
    # - cron: '0 0 * * *'
    # Once an hour
    - cron: '0 * * * *'
env:
  IMAGE_NAME: foo-app
  IMAGE_OWNER: ${{ github.repository_owner }}
  # Tag for release images
  # IMAGE_TAG: ${{ (github.ref == 'refs/heads/main' && 'staging') || (github.ref == 'refs/heads/qa' && 'qa') }}
  IMAGE_TAG: latest
  IMAGE_VER: ${{ github.sha }}
  # Variant that is deployed
  PROD_VAR: 1.14.3-erlang-25.2.3-distroless-bullseye-20230202-slim
  # Variant if test matrix is not used
  VAR: debian
  DOCKER_FILE: deploy/debian.Dockerfile
jobs:
  scan:
    name: Security scan prod image
    runs-on: ubuntu-latest
    permissions:
      # Interact with GitHub OIDC Token endpoint for AWS
      id-token: write
      contents: read

      # Read from ghcr.io repository
      packages: read

      # Upload JUnit report files
      # https://github.com/EnricoMi/publish-unit-test-result-action#permissions
      checks: write
      pull-requests: write
      issues: read

      # Upload SARIF report files
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        os: [alpine, chiseled, debian, distroless, ubuntu]
        elixir: [1.14.3]
        include:
          - os: alpine
            otp: 24.3.4.6
            build_os_ver: '3.15.6'
            prod_os_ver: '3.15.6'
          - os: alpine
            otp: 25.2.3
            build_os_ver: '3.17.0'
            prod_os_ver: '3.17.0'
          - os: chiseled
            build_os_ver: jammy-20221130
            prod_os_ver: jammy-20221130
            otp: 25.2.3
          - os: debian
            build_os_ver: bullseye-20230109-slim
            prod_os_ver: bullseye-slim
            snapshot_ver: '20230109'
            otp: 24.3.4.9
          - os: debian
            build_os_ver: bullseye-20230109-slim
            prod_os_ver: bullseye-slim
            snapshot_ver: '20230109'
            otp: 25.2.3
          - os: debian
            build_os_ver: bullseye-20230202-slim
            prod_os_ver: bullseye-slim
            snapshot_ver: '20230202'
            otp: 24.3.4.9
          - os: debian
            build_os_ver: bullseye-20230202-slim
            prod_os_ver: bullseye-slim
            snapshot_ver: '20230202'
            otp: 25.2.3
          - os: distroless
            build_os_ver: bullseye-20230202-slim
            prod_os_ver: bullseye-slim
            snapshot_ver: ''
            otp: 25.2.3
          - os: ubuntu
            build_os_ver: jammy-20221130
            prod_os_ver: jammy-20221130
            otp: 24.3.4.9
          - os: ubuntu
            build_os_ver: jammy-20221130
            prod_os_ver: jammy-20221130
            otp: 25.2.3
    env:
      DOCKER_FILE: deploy/${{ matrix.os }}.Dockerfile
      VAR: ${{ matrix.elixir }}-erlang-${{ matrix.otp }}-${{ matrix.os }}-${{ matrix.build_os_ver }}
    steps:
      - name: Log in to GHCR
        uses: docker/#-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull image
        run: docker pull ghcr.io/${{env.IMAGE_OWNER}}/${{env.IMAGE_NAME}}:${{ env.VAR }}${{ env.IMAGE_VER }}

      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@master
        # https://github.com/aquasecurity/trivy-action
        # https://github.com/marketplace/actions/aqua-security-trivy#inputs
        with:
          image-ref: ghcr.io/${{env.IMAGE_OWNER}}/${{env.IMAGE_NAME}}:${{ env.VAR }}${{ env.IMAGE_VER }}
          # exit-code: '1' # fail build
          # ignore-unfixed: true
          # vuln-type: 'os,library'
          # severity: 'CRITICAL,HIGH'
          # cache-dir: /var/cache
          format: 'sarif'
          output: 'trivy.sarif'

      - name: Display scan results
        run: cat trivy.sarif | jq .

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        # Requires GitHub Advanced Security
        # https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
        # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
        # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
        if: always()
        with:
          sarif_file: 'trivy.sarif'
          category: trivy

      - name: Scan image with Grype
        uses: anchore/scan-action@v3
        # https://github.com/marketplace/actions/anchore-container-scan
        id: scan-grype
        with:
          image: ghcr.io/${{env.IMAGE_OWNER}}/${{env.IMAGE_NAME}}:${{ env.VAR }}${{ env.IMAGE_VER }}
          # severity-cutoff: critical
          fail-build: false
          output-format: 'sarif'
          # output-format: table

      - name: Display scan results
        run: cat ${{ steps.scan-grype.outputs.sarif }} | jq .

      - name: Upload Grype scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: ${{ steps.scan-grype.outputs.sarif }}
          category: grype

      # - name: Scan image with snyk
      #   # if: github.event_name != 'pull_request'
      #   uses: snyk/actions/docker@master
      #   continue-on-error: true
      #   env:
      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      #   with:
      #     command: test
      #     image: ghcr.io/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}:${{ env.VAR }}${{ env.IMAGE_VER }}
      #     args: --file=${{ env.DOCKER_FILE }} --project-name=api