Image scanning

[HarshCasper]

Think of this PR as more of a discussion.

Changes introduced in this PR:

• Move Dockerfile linting before the Docker build process
• Add security scanning using trivy

Types of changes

What types of changes does your PR introduce?

Put an x in the boxes that apply

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features to not work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe):

Testing

Requires testing

• Yes
• No

In case you checked yes, did you write tests?

• Yes
• No

Further comments

This PR is a step ahead for DevSecOps tooling integration for QHub CI, as discussed in this issue #891.

For implementing container scan, I looked into various tools:

• Docker Scan using Snyk
• Azure Container Scan using Trivy
• Official Trivy action

By going through blogs and resource materials, it appeared that Trivy might suit our needs to implement a container security CI before publishing Docker images. In this regard, the Azure Container Scan was a good option, but its timeout failure while scanning large images was a serious blocker.

To tackle this, I looked into the official Trivy action and given the fact that it is open-source and fairly easy to set up, I have integrated it.

I would love to hear what others have to say about this proposed change!

[viniciusdc]

Hi @HarshCasper it seems I was able to fix the issue, you were passing an array to the image-ref filed which is not supported. I added an extra var to pick the first one*. Also, there is two things I just noticed:

• Updating the Trivy DB takes some time, if it's not cached we might need to transform this step into a CRON job -- separated from PRs
• There are no current error logs from Trivy step, is there a debug mode we can use?

*we might need to pick the second now that I think because the sha is more detailed than the tag

[viniciusdc]

As a matter of fact, code-server seems to be using trivy as well and looks really good as a policy standard https://github.com/coder/code-server/security/policy