7 add CVE check to ci

.github/workflows/main.yml

@@ -6,7 +6,6 @@ jobs:
 
   lint-gradle-project:
     runs-on: ubuntu-latest
-
     steps:
     - name: Checkout project source
       uses: actions/checkout@v4
@@ -48,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@v3
@@ -62,5 +61,22 @@ jobs:
           push: true
           tags: ${{ vars.DOCKER_IMAGE_NAME }}:latest
 
+  cve-check:
+    runs-on: ubuntu-latest
+    needs: build-docker
 
-    needs: lint-gradle-project
+    steps:
+    - run: curl https://raw.githubusercontent.com/aquasecurity/trivy/7735ec432a83d5446d13a593ab3b27dd02649ca1/contrib/markdown.tpl -o markdown.tpl
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@0.20.0
+      with:
+        image-ref: ${{ vars.DOCKER_IMAGE_NAME }}:latest
+        format: 'template'
+        template: '@markdown.tpl'
+        output: trivy.md
+        exit-code: '1'
+        ignore-unfixed: true
+        vuln-type: 'os,library'
+        severity: 'CRITICAL,HIGH'
+    - run: cat trivy.md >> $GITHUB_STEP_SUMMARY
+      if: always()

Dockerfile

@@ -1,8 +1,8 @@
 FROM gradle:latest AS build
 WORKDIR /app
 COPY . .
-RUN ./gradlew assemble
+RUN ./gradlew assemble --no-daemon
 
-FROM openjdk:17-jdk-slim AS runtime
+FROM openjdk:23-slim-bookworm AS runtime
 COPY --from=build /app/build/libs/ctcd-0.0.1-SNAPSHOT.jar /app/ctcd-0.0.1-SNAPSHOT.jar
 ENTRYPOINT ["java", "-jar", "/app/ctcd-0.0.1-SNAPSHOT.jar"]