vulnerability-scans.yml

# GitHub Actions CI workflow that runs vulnerability scans on the application's Docker image
# to ensure images built are secure before they are deployed.

name: Vulnerability Scans

on:
  workflow_call:
    inputs:
      app_name:
        description: "name of application folder under infra directory"
        required: true
        type: string

jobs:
  hadolint-scan:
    name: Hadolint Scan
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      # Scans Dockerfile for any bad practices or issues
      - name: Scan Dockerfile by hadolint
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ${{ inputs.app_name }}/Dockerfile
          format: tty
          failure-threshold: warning
          output-file: hadolint-results.txt

      - name: Save output to workflow summary
        if: always() # Runs even if there is a failure
        run: |
          cat hadolint-results.txt >> "$GITHUB_STEP_SUMMARY"

  build-and-cache:
    runs-on: ubuntu-22.04
    outputs:
      image: ${{ steps.shared-output.outputs.image }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@master

      - name: Cache Docker layers
        id: cache-buildx
        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: ${{ inputs.app_name }}-buildx-${{ github.sha }}
          restore-keys: |
            ${{ inputs.app_name }}-buildx-

      - name: Ensure Buildx cache exists
        run: |
          mkdir -p /tmp/.buildx-cache

      - name: Set shared outputs
        id: shared-output
        run: |
          IMAGE_NAME=$(make APP_NAME=${{ inputs.app_name }} release-image-name)
          IMAGE_TAG=$(make release-image-tag)
          echo "image=$IMAGE_NAME:$IMAGE_TAG" >> "$GITHUB_OUTPUT"

      - name: Build and tag Docker image for scanning
        # If there's an exact match in cache, skip build entirely
        if: steps.cache-buildx.outputs.cache-hit != 'true'
        run: |
          make release-build \
          APP_NAME=${{ inputs.app_name }} \
          OPTIONAL_BUILD_FLAGS=" \
          --cache-from=type=local,src=/tmp/.buildx-cache \
          --cache-to=type=local,dest=/tmp/.buildx-cache"

      - name: Save Docker image
        if: steps.cache-buildx.outputs.cache-hit != 'true'
        run: |
          docker save ${{ steps.shared-output.outputs.image }} > /tmp/docker-image.tar

      - name: Cache Docker image
        if: steps.cache-buildx.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: /tmp/docker-image.tar
          key: ${{ inputs.app_name }}-docker-image-${{ github.sha }}

  trivy-scan:
    name: Trivy Scan
    runs-on: ubuntu-22.04
    needs: build-and-cache

    steps:
      - uses: actions/checkout@v4

      - name: Get current date
        id: date
        run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"

      - name: Restore cached trivy vulnerability and Java DBs
        id: trivy-cache
        uses: actions/cache/restore@v4
        with:
          path: ${{ github.workspace }}/.cache/trivy
          key: trivy-cache-${{ steps.date.outputs.date }}

      # Download and extract the vulnerability DB and Java DB
      # This is based on the instructions here:
      # https://github.com/aquasecurity/trivy-action/?tab=readme-ov-file#updating-caches-in-the-default-branch

      - name: Setup oras
        if: steps.trivy-cache.outputs.cache-hit != 'true'
        uses: oras-project/setup-oras@v1

      - name: Download and extract the vulnerability DB
        if: steps.trivy-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p "$GITHUB_WORKSPACE/.cache/trivy/db"
          oras pull ghcr.io/aquasecurity/trivy-db:2
          tar -xzf db.tar.gz -C "$GITHUB_WORKSPACE/.cache/trivy/db"
          rm db.tar.gz

      - name: Download and extract the Java DB
        if: steps.trivy-cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p "$GITHUB_WORKSPACE/.cache/trivy/java-db"
          oras pull ghcr.io/aquasecurity/trivy-java-db:1
          tar -xzf javadb.tar.gz -C "$GITHUB_WORKSPACE/.cache/trivy/java-db"
          rm javadb.tar.gz

      - name: Cache DBs
        if: steps.trivy-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: ${{ github.workspace }}/.cache/trivy
          key: trivy-cache-${{ steps.date.outputs.date }}

      - name: Restore cached Docker image
        uses: actions/cache/restore@v4
        with:
          path: /tmp/docker-image.tar
          key: ${{ inputs.app_name }}-docker-image-${{ github.sha }}
          restore-keys: |
            ${{ inputs.app_name }}-docker-image-

      - name: Load cached Docker image
        run: |
          docker load < /tmp/docker-image.tar

      - name: Run Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: image
          image-ref: ${{ needs.build-and-cache.outputs.image }}
          format: table
          exit-code: 1
          ignore-unfixed: true
          vuln-type: os
          scanners: vuln,secret
        env:
          TRIVY_SKIP_DB_UPDATE: true
          TRIVY_SKIP_JAVA_DB_UPDATE: true
          # PyJWT has an example with a fake JWT that Trivy flags.
          # see: https://github.com/aquasecurity/trivy/discussions/5772
          TRIVY_SKIP_FILES: "/api/.venv/lib/python*/site-packages/PyJWT-*.dist-info/METADATA"

      - name: Save output to workflow summary
        if: always() # Runs even if there is a failure
        run: |
          echo "View results in GitHub Action logs" >> "$GITHUB_STEP_SUMMARY"

  anchore-scan:
    name: Anchore Scan
    runs-on: ubuntu-22.04
    needs: build-and-cache

    steps:
      - uses: actions/checkout@v4

      - name: Restore cached Docker image
        uses: actions/cache/restore@v4
        with:
          path: /tmp/docker-image.tar
          key: ${{ inputs.app_name }}-docker-image-${{ github.sha }}
          restore-keys: |
            ${{ inputs.app_name }}-docker-image-

      - name: Load cached Docker image
        run: |
          docker load < /tmp/docker-image.tar

      - name: Run Anchore vulnerability scan
        if: always() # Runs even if there is a failure
        uses: anchore/scan-action@v4
        id: anchore-scan-json
        with:
          image: ${{ needs.build-and-cache.outputs.image }}
          output-format: json
          fail-build: true
          severity-cutoff: medium

      - name: Run Anchore vulnerability scan
        if: always() # Runs even if there is a failure
        uses: anchore/scan-action@v4
        with:
          image: ${{ needs.build-and-cache.outputs.image }}
          output-format: table
          fail-build: true
          severity-cutoff: medium

      - name: Print output to workflow summary
        if: always() # Runs even if there is a failure
        run: |
          jq '.matches | map(.artifact | { name, version, location: .locations[0].path })' ${{ steps.anchore-scan-json.outputs.json }}

  dockle-scan:
    name: Dockle Scan
    runs-on: ubuntu-22.04
    needs: build-and-cache

    steps:
      - uses: actions/checkout@v4

      - name: Restore cached Docker image
        uses: actions/cache/restore@v4
        with:
          path: /tmp/docker-image.tar
          key: ${{ inputs.app_name }}-docker-image-${{ github.sha }}
          restore-keys: |
            ${{ inputs.app_name }}-docker-image-

      - name: Load cached Docker image
        run: |
          docker load < /tmp/docker-image.tar

      # Dockle doesn't allow you to have an ignore file for the DOCKLE_ACCEPT_FILES
      # variable, this will save the variable in this file to env for Dockle
      - name: Set any acceptable Dockle files
        run: |
          if grep -q "^DOCKLE_ACCEPT_FILES=.*" .dockleconfig; then
            grep -s '^DOCKLE_ACCEPT_FILES=' .dockleconfig >> "$GITHUB_ENV"
          fi

      - name: Run Dockle container linter
        uses: erzz/dockle-action@v1.4.0
        with:
          image: ${{ needs.build-and-cache.outputs.image }}
          exit-code: "1"
          failure-threshold: WARN
          accept-filenames: ${{ env.DOCKLE_ACCEPT_FILES }}

      - name: Save output to workflow summary
        if: failure() # Only runs if there is a failure
        run: |
          {
            echo '```json'
            cat dockle-report.json
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"