Add Trivy vulnerability scanning workflow

[stnguyen90]

What does this PR do?

Install standard Trivy GitHub workflow template so that Trivy scans our docker image for vulns regularly.

Test Plan

None

Related PRs and Issues

None

Have you read the Contributing Guidelines on issues?

Yes

Summary by CodeRabbit

• Chores
  • Added automated vulnerability scanning to CI: scans run on pushes, pull requests, and a scheduled cron; the pipeline builds the project image, runs a vulnerability scan focused on high/critical findings, and uploads results (SARIF) to the repository Security tab for centralized visibility and reporting.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

A new GitHub Actions workflow was added at .github/workflows/trivy.yml named "trivy". It runs on pushes to main, pull requests targeting main, and a cron schedule. The job checks out the repository, builds a Docker image from the repository Dockerfile (tagged with the commit SHA), runs Trivy against that image producing a SARIF report filtered to HIGH and CRITICAL severities, and uploads the SARIF to GitHub Security using the CodeQL upload-sarif action. Workflow permissions for contents, security-events, and actions are set.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify Trivy command flags, SARIF template, and severity filtering (HIGH/CRITICAL)
• Confirm workflow triggers (push to main, PRs targeting main, cron) match intent
• Validate workflow permissions: contents: read, security-events: write, actions: read
• Check Docker build step and image tagging (uses commit SHA)
• Confirm upload-sarif action usage and SARIF file path/name

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Add Trivy vulnerability scanning workflow' directly and concisely summarizes the main change: adding a new GitHub Actions workflow for Trivy vulnerability scanning.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore-trivy-scanning

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 43b5589 and b1d9982.

📒 Files selected for processing (1)

• .github/workflows/trivy.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build
• GitHub Check: Build

🔇 Additional comments (2)

.github/workflows/trivy.yml (2)

34-34: Verify image registry alignment with publishing strategy.

The image reference appwrite/docker-base defaults to Docker Hub without an explicit registry prefix. Confirm this matches the repository's publishing strategy. For GitHub-hosted projects, using GHCR (ghcr.io/appwrite/docker-base) is often more appropriate and avoids external Docker Hub dependencies.

If the repository publishes to GHCR, update both occurrences:

- docker build -t appwrite/docker-base:${{ github.sha }} .
+ docker build -t ghcr.io/appwrite/docker-base:${{ github.sha }} .

- image-ref: 'appwrite/docker-base:${{ github.sha }}'
+ image-ref: 'ghcr.io/appwrite/docker-base:${{ github.sha }}'

Alternatively, make this configurable via environment variable:

env:
  REGISTRY_IMAGE: ghcr.io/appwrite/docker-base

Then use ${{ env.REGISTRY_IMAGE }} in both places.

Also applies to: 39-39

---

1-48: Verify that Dockerfile exists in repository root.

The workflow assumes a Dockerfile exists at the repository root (line 34: docker build -t appwrite/docker-base:${{ github.sha }} .). Ensure the Dockerfile is present and buildable without errors, as workflow will fail if the build step cannot locate or parse the Dockerfile.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/trivy.yml (1)

46-46: Consider pinning the CodeQL action to a specific commit for consistency.

The CodeQL upload action uses a floating v3 tag, while the Trivy action is pinned to a specific commit. For better supply-chain security and reproducibility, consider pinning the CodeQL action to a specific commit as well.

-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@4355270c2f9846dca18e85b5f6653c0a1cb02e5c

To find the latest commit SHA for a given version tag, you can check the GitHub repository or use the GitHub CLI.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 5e3f3b2 and 43b5589.

📒 Files selected for processing (1)

• .github/workflows/trivy.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build
• GitHub Check: Build

🔇 Additional comments (1)

.github/workflows/trivy.yml (1)

37-37: Trivy action commit SHA is valid.

The commit 7b7aa264d83dc58691451798b4d117d53d21edfe exists in the official aquasecurity/trivy-action repository. It was authored by simar7 on 2022-06-22 with the message "feat(SBOM): Support SBOM generation (#129)". The pinned commit is authentic and verified.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.