[FEATURE] Scans container images for vulnerabilities workflow

[dimetron]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow our Code of Conduct

📝 Feature Summary

No response

❓ Problem Statement / Motivation

We are missing container images scans for vulnerabilities

💡 Proposed Solution

• add Scans container images for vulnerabilities
• add RADME badge for the same

🔄 Alternatives Considered

No response

🎯 Affected Service(s)

None

📚 Additional Context

No response

🙋 Are you willing to contribute?

• I am willing to submit a PR for this feature

[dimetron]

From existing open source scanners we have few options

• https://github.com/marketplace/actions/anchore-container-scan
• https://github.com/marketplace/actions/aqua-security-trivy

      - name: Anchore Container Scan
        uses: anchore/scan-action@v3.6.4
        with:
          image: docker-archive:${{ runner.temp }}/${{ matrix.image }}.tar
          fail-build: false # Optional: set to true to fail the build on vulnerabilities
          severity-cutoff: high # Optional: set the severity cutoff

      - name: Image vulnerability scanner
        uses: aquasecurity/trivy-action@master
        if: matrix.image != cli
        with:
          image-ref: '${{ runner.temp }}/${{ matrix.image }}.tar'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

[dimetron]

🔍 Container Image Scanner Comparison: Anchore vs Trivy

🛠️ 1. Basic Functionality

Feature	Anchore Container Scan	Trivy (Aqua Security)
Image Vulnerability Scanning	✅ Yes	✅ Yes
SBOM Generation	✅ Yes (Syft-based)	✅ Yes
OSS License Detection	❌ No (in GitHub Action)	✅ Yes
Misconfiguration Scanning	❌ No	✅ Yes (Kubernetes, Terraform, etc.)
Secrets Scanning	❌ No	✅ Yes
Performance	Moderate (pulls Syft and Grype)	Fast and lightweight

---

⚙️ 2. Integration & Output

Feature	Anchore Container Scan	Trivy (Aqua Security)
Output Format Support	JSON, SARIF, table	JSON, SARIF, table, CycloneDX SBOM
GitHub Code Scanning Support	✅ Yes (SARIF)	✅ Yes (SARIF)
CI/CD Friendly	✅ Yes	✅ Yes
Dockerless Mode	✅ Yes	✅ Yes

---

📦 3. OSS Friendliness & Ecosystem

Factor	Anchore Container Scan	Trivy (Aqua Security)
Open Source Licensing	Apache 2.0	Apache 2.0
Community Size & Activity	Moderate	Large, very active
Ecosystem Integration	Anchore Enterprise (optional)	Broad: containers, SBOM, IaC, registries
Default DB Updates	Frequently, but may lag slightly	Fast, updated every 6 hours

---

✅ Recommendation

Best for OSS Image Scanning: Trivy

Why Trivy?

• Broader scanning capabilities (vulnerabilities, licenses, secrets, misconfigs)
• Lightweight and fast
• GitHub-native integration with SARIF support
• Actively maintained with frequent vulnerability DB updates