feat: add trivy vulnerability check

[emanuelaepure10]

Trivy vulnerability check is added the GitHub Actions workflows.

ING-4183

[stempler]

Since we need a built hale studio to scan in rootfs mode I think it would make more sense to integrate the scan into a workflow that anyway already creates a hale studio artifact.

[emanuelaepure10]

sure. But this can be done as well after we understood which tool we like the most, right?

[stempler]

Do you refer to trivy and codeql?
In my view both serve different purposes so both should be included.

[emanuelaepure10]

Also in my view Trivy and CodeQL have different focuses, they complement each other very well and using them both we can cover both dependency vulnerabilities and code-level issues, but I thought that trivy is favourite and we care less about the rest :-)

[stempler]

@emanuelaepure10 So can we proceed in that you adapt the trivy scan to scan the product, or what would be your plan?

[emanuelaepure10]

@stempler could you please help me understand which is the correct directory to scan? Thank you

[stempler]

We had discussed in a call around May 8th that a built product should be scanned, why I suggested here to integrate the scan into a workflow where products are built anyway.
There is also an earlier discussion where I asked about what you are scanning and referred to a comment on a previous ticket that refers to how we did scans manually in the past. Did you take a look at these resources? Do you have specific open questions?

[emanuelaepure10]

@stempler Do you maybe see why the file is not updated with the results?

[stempler]

It seems the upload works but there are are just no results - I would guess maybe because the product archive is not extracted.

Would the goal not be to use the github/codeql-action/upload-sarif action again to integrate with GitHub code scanning?

[stempler]

Why don't you use the trivy GitHub action as before?

[emanuelaepure10]

If I don't set up/install trivy I get an error as:

Run trivy fs --severity CRITICAL,HIGH build/target/hale-studio-linux-trivy --format sarif --output trivy-results.sarif
/home/runner/work/_temp/1ea9265f-f612-4cca-8[7](https://github.com/halestudio/hale/actions/runs/9449564750/job/26026128237?pr=1159#step:10:8)d1-b6e3a263f8f2.sh: line 1: trivy: command not found

See here

[stempler]

Did you test if it works on the archive or would it need to be extracted first?

[emanuelaepure10]

I've tried but I got the same result.

[stempler]

It seems the upload works but there are are just no results - I would guess maybe because the product archive is not extracted.

Would the goal not be to use the github/codeql-action/upload-sarif action again to integrate with GitHub code scanning?

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[emanuelaepure10]

@stempler I'm unsure how to proceed with this PR and would greatly appreciate your assistance. Thank you!

[stempler]

I'm unsure how to proceed with this PR and would greatly appreciate your assistance. Thank you!

@emanuelaepure10 From my perspective the open tasks would be:

• use the trivy GitHub action (as you had done in the beginning) instead of installing it and running it via the CLI
• I suspect the fs scan does not yield any results, at least that was the case for me when I tested this, so I suspect rootfs has to be used instead
• looking at the code scanning section it seems that in the end, the trivy scan should be running for the master branch and not only for the PR, but this can be done once the process is working

How would one usually find the code scanning results for a PR (e.g. is there a link somewhere?)
I found it not so easy to find the info for this PR.

[emanuelaepure10]

@stempler I have updated the PR and I completely agree with you that would be so much nicer to have a link directly from the PR to the code scanning results. At the moment when you go to the security tab -> code scanning you could select the PR or the branch you are interested in

but working with forks you would probably need to select always the PR instead of a branch.
Another option could be to create a PR with the vulnerabilities found.
What would you prefer?

wrong commit type

[stempler]

Replaced by #1204