Merge pull request #198 from sir-gon/develop

Develop

Author: sir-gon

.github/workflows/docker-image.yml

@@ -157,7 +157,7 @@ jobs:
         with:
           sarif_file: 'snyk.sarif'
   scan:
-    name: "Trivy"
+    name: "Trivy (sarif)"
     runs-on: ubuntu-latest
     needs: build
     permissions:
@@ -187,3 +187,25 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'trivy-results.sarif'
+
+  report:
+    name: "Trivy (report)"
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ env.ARTIFACT_NAME }}_prod
+          path: /tmp/
+
+      - name: Load image
+        run: |
+          docker load --input /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
+          docker image ls -a
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
+          format: 'table'

Dockerfile

@@ -5,6 +5,8 @@ ENV WORKDIR=/app
 WORKDIR ${WORKDIR}
 
 RUN apk add --update --no-cache make
+RUN apk upgrade --update --no-cache openssl libcrypto3 libssl3 # FIX CVE-2024-5535
+RUN apk upgrade --update --no-cache --available # FIX CVE-2024-5535 CVE-2024-4741
 
 ###############################################################################
 FROM base AS lint
@@ -92,6 +94,8 @@ CMD ["make", "test"]
 ## WORKDIR and USER are maintained
 ##
 FROM eclipse-temurin:22.0.1_8-jre-alpine AS production
+RUN apk upgrade --update --no-cache openssl libcrypto3 libssl3 # FIX CVE-2024-5535
+RUN apk upgrade --update --no-cache --available # FIX CVE-2024-5535 CVE-2024-4741
 
 ENV LOG_LEVEL=INFO
 ENV BRUTEFORCE=false