feat: introduce cve scanning (#2772)

.docker/Dockerfile-alpine

@@ -1,4 +1,4 @@
-FROM alpine:3.13.4
+FROM alpine:3.14.2
 
 RUN addgroup -S ory; \
     adduser -S ory -G ory -D -H -s /bin/nologin

.docker/Dockerfile-build

@@ -16,7 +16,7 @@ ADD . .
 
 RUN go build -tags sqlite -o /usr/bin/hydra
 
-FROM alpine:3.13.4
+FROM alpine:3.14.2
 
 RUN addgroup -S ory; \
     adduser -S ory -G ory -D  -h /home/ory -s /bin/nologin; \

.docker/Dockerfile-scratch

@@ -1,4 +1,4 @@
-FROM alpine:3.13.4
+FROM alpine:3.14.2
 
 RUN apk add -U --no-cache ca-certificates
 

.docker/Dockerfile-sqlite

@@ -1,4 +1,4 @@
-FROM alpine:3.13.4
+FROM alpine:3.14.2
 
 # Because this image is built for SQLite, we create /home/ory and /home/ory/sqlite which is owned by the ory user
 # and declare /home/ory/sqlite a volume.

.github/workflows/cve-scan.yaml

@@ -0,0 +1,31 @@
+name: Docker Image Scan
+on:
+  push:
+    branches:
+      - 'master'
+    tags:
+      - 'v*.*.*'
+  pull_request:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Build images
+        shell: bash
+        run: |
+          make docker
+      - name: Scan image Sqlite
+        uses: anchore/scan-action@v3
+        with:
+          image: oryd/hydra:latest-sqlite
+          fail-build: true
+          severity-cutoff: high

Makefile

@@ -63,7 +63,7 @@ test-resetdb: node_modules
 		docker run --rm --name hydra_test_database_postgres -p 3445:5432 -e POSTGRES_PASSWORD=secret -e POSTGRES_DB=postgres -d postgres:9.6
 		docker run --rm --name hydra_test_database_cockroach -p 3446:26257 -d cockroachdb/cockroach:v20.2.6 start-single-node --insecure
 
-# Runs tests in short mode, without database adapters
+# Build local docker images
 .PHONY: docker
 docker:
 		docker build -f .docker/Dockerfile-build -t oryd/hydra:latest-sqlite .