Add scanning for misconfigurations

[ppawlowski]

Description

Add step in the pipeline to validate helm chart against best practices and misconfigurations.

Related Issue(s)

#213

Checklist

• I have read the contribution guidelines
• Suitable unit/system level tests have been added and they pass
• Documentation has been updated
  • Upgrade instructions
  • Configuration details
  • Concepts
• Changes flowforge.yml?
  • Issue/PR raised on FlowFuse/helm to update ConfigMap Template
  • Issue/PR raised on FlowFuse/CloudProject to update values for Staging/Production

Labels

• Backport needed? -> add the backport label
• Includes a DB migration? -> add the area:migration label

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[github-actions]

node-red:3.1.x-main-linux-amd64 scan results

0 tests  ±0   0 ✔️ ±0   0s ⏱️ ±0s
2 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

node-red:2.2.3-main-linux-amd64 scan results

  1 files  ±0  4 suites  ±0   0s ⏱️ ±0s
20 tests ±0  0 ✔️ ±0  0 💤 ±0  20 ❌ ±0 
21 runs  ±0  0 ✔️ ±0  0 💤 ±0  21 ❌ ±0 

For more details on these failures, see this check.

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

node-red:3.0.2-main-linux-amd64 scan results

1 files  ±0  4 suites  ±0   0s ⏱️ ±0s
4 tests  - 6  0 ✔️ ±0  0 💤 ±0  4 ❌  - 6 
5 runs   - 6  0 ✔️ ±0  0 💤 ±0  5 ❌  - 6 

For more details on these failures, see this check.

Results for commit 7602b20. ± Comparison against base commit 721173e.

This pull request removes 6 tests.

axios-0.27.2 ‑ [MEDIUM] CVE-2023-45857
curl-8.4.0-r0 ‑ [MEDIUM] CVE-2023-46218
libcrypto3-3.1.4-r0 ‑ [MEDIUM] CVE-2023-5678
libcurl-8.4.0-r0 ‑ [MEDIUM] CVE-2023-46218
libssl3-3.1.4-r0 ‑ [MEDIUM] CVE-2023-5678
openssl-3.1.4-r0 ‑ [MEDIUM] CVE-2023-5678

[github-actions]

node-red:3.1.x-main-linux-arm64 scan results

0 tests  ±0   0 ✔️ ±0   0s ⏱️ ±0s
2 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

node-red:2.2.3-main-linux-arm64 scan results

  1 files  ±0  4 suites  ±0   0s ⏱️ ±0s
19 tests ±0  0 ✔️ ±0  0 💤 ±0  19 ❌ ±0 
20 runs  ±0  0 ✔️ ±0  0 💤 ±0  20 ❌ ±0 

For more details on these failures, see this check.

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

forge-k8s:main-linux-amd64 scan results

1 tests  ±0   0 ✔️ ±0   0s ⏱️ ±0s
4 suites ±0   0 💤 ±0 
1 files   ±0   1 ❌ ±0 

For more details on these failures, see this check.

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

file-server:main-linux-amd64 scan results

0 tests  ±0   0 ✔️ ±0   0s ⏱️ ±0s
2 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

node-red:3.0.2-main-linux-arm64 scan results

1 files  ±0  4 suites  ±0   0s ⏱️ ±0s
4 tests  - 6  0 ✔️ ±0  0 💤 ±0  4 ❌  - 6 
5 runs   - 6  0 ✔️ ±0  0 💤 ±0  5 ❌  - 6 

For more details on these failures, see this check.

Results for commit 7602b20. ± Comparison against base commit 721173e.

This pull request removes 6 tests.

axios-0.27.2 ‑ [MEDIUM] CVE-2023-45857
curl-8.4.0-r0 ‑ [MEDIUM] CVE-2023-46218
libcrypto3-3.1.4-r0 ‑ [MEDIUM] CVE-2023-5678
libcurl-8.4.0-r0 ‑ [MEDIUM] CVE-2023-46218
libssl3-3.1.4-r0 ‑ [MEDIUM] CVE-2023-5678
openssl-3.1.4-r0 ‑ [MEDIUM] CVE-2023-5678

[github-actions]

file-server:main-linux-arm64 scan results

0 tests  ±0   0 ✔️ ±0   0s ⏱️ ±0s
2 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 7602b20. ± Comparison against base commit 721173e.

[github-actions]

forge-k8s:main-linux-arm64 scan results

1 tests  ±0   0 ✔️ ±0   0s ⏱️ ±0s
4 suites ±0   0 💤 ±0 
1 files   ±0   1 ❌ ±0 

For more details on these failures, see this check.

Results for commit 7602b20. ± Comparison against base commit 721173e.

[hardillb]

Looks like the re-spin of the 3.0.2 removed all the OS level CVEs (only npm left by the look of it)