Add Anchore Go dependency security scanning

.github/workflows/linting.yml

@@ -113,6 +113,28 @@ jobs:
       - name: Run shellcheck
         run: make shellcheck
 
+  vulnerability-scan:
+    name: Vulnerability Scanning
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+      - name: Run Anchore vulnerability scanner
+        uses: anchore/scan-action@516844f15d82b6cdd0765b87aab79ed3ac006225
+        id: scan
+        with:
+          path: "."
+          fail-build: true
+          severity-cutoff: negligible
+      - name: Show Anchore scan SARIF report
+        if: always()
+        run: cat ${{ steps.scan.outputs.sarif }}
+      - name: Upload Anchore scan SARIF report
+        if: always()
+        uses: github/codeql-action/upload-sarif@0c670bbf0414f39666df6ce8e718ec5662c21e03
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+
   yaml-lint:
     name: YAML
     runs-on: ubuntu-latest

.github/workflows/report.yml

@@ -0,0 +1,29 @@
+---
+name: Reporting
+
+on:
+  push:
+    branches:
+      - devel
+      - release-*
+
+jobs:
+  vulnerability-scan:
+    name: Vulnerability Scanning
+    if: github.repository_owner == 'submariner-io'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+      - name: Run Anchore vulnerability scanner
+        uses: anchore/scan-action@516844f15d82b6cdd0765b87aab79ed3ac006225
+        id: scan
+        with:
+          path: "."
+          fail-build: false
+      - name: Show Anchore scan SARIF report
+        run: cat ${{ steps.scan.outputs.sarif }}
+      - name: Upload Anchore scan SARIF report
+        uses: github/codeql-action/upload-sarif@0c670bbf0414f39666df6ce8e718ec5662c21e03
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}

.grype.yaml

@@ -0,0 +1,12 @@
+---
+ignore:
+  # False positive, CVE is actually about the C++ project protocolbuffers/protobuf
+  # https://github.com/anchore/grype/issues/558
+  - vulnerability: CVE-2015-5237
+    package:
+      name: google.golang.org/protobuf
+  # False positive, CVE is actually about the C++ project protocolbuffers/protobuf
+  # https://github.com/anchore/grype/issues/633
+  - vulnerability: CVE-2021-22570
+    package:
+      name: google.golang.org/protobuf