vulnerability_scan_subworkflow.yml

name: Vulnerability Scan

on:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string
    secrets:
      SNYK_TOKEN:
        required: true
  workflow_dispatch:
    inputs:
      ref:
        required: true
        type: string

jobs:
  scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - label: oss
            distribution_zip_name: hazelcast-distribution.zip
          - label: enterprise
            distribution_zip_name: hazelcast-enterprise-distribution.zip
    env:
      DIRECTORY: hazelcast-${{ matrix.image.label }}
      IMAGE_TAG: hazelcast/${{ matrix.image.label }}:${{ github.sha }}
    steps:
      - name: Checkout Code at ${{ inputs.ref }} branch
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}

      - name: Generate ${{ matrix.image.label }} dist ZIP
        run: |
          # Make a dummy empty ZIP file to avoid scanning Java dependencies, as managed downstream
          # DI-50 - Remove java artifacts scanning from hazelcast-docker
          working_directory=hazelcast-distribution
          mkdir -p ${working_directory}/lib
          mkdir -p ${working_directory}/bin
          touch ${working_directory}/bin/empty

          zip -r ${{ env.DIRECTORY }}/${{ matrix.image.distribution_zip_name }} ${working_directory}

      - name: Build ${{ matrix.image.label }} image
        run: |
          docker build -t ${{ env.IMAGE_TAG }} ${{ env.DIRECTORY }}

      - name: Scan ${{ matrix.image.label }} image by Trivy
        if: always()
        uses: aquasecurity/trivy-action@0.29.0
        with:
          image-ref: ${{ env.IMAGE_TAG }} 
          trivy-config: .github/containerscan/trivy.yaml
        env:
          # https://github.com/aquasecurity/trivy/issues/2432
          DOCKLE_HOST: "unix:///var/run/docker.sock"

      - name: Scan ${{ matrix.image.label }} image by Dockle
        if: always()
        # Use our fork until https://github.com/goodwithtech/dockle-action/issues/7 is fixed
        # uses: goodwithtech/dockle-action@main
        uses: hazelcast/dockle-action/@Upgrade-Dockle-to-`0.4.14`
        with:
          image: ${{ env.IMAGE_TAG }} 
          format: 'list'
          exit-code: '1'
          exit-level: 'warn'
          # too many false positives, we don't use credentials in Dockerfile
          ignore: 'CIS-DI-0010'

      - name: Scan ${{ matrix.image.label }} image by Snyk
        if: always()
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.IMAGE_TAG }} 
          args: --file=${{ env.DIRECTORY }}/Dockerfile --policy-path=.github/containerscan --severity-threshold=high --exclude-base-image-vulns