Add KICS scan for image

.github/workflows/validate.yml

@@ -25,6 +25,22 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Scan the Dockerfile with KICS to check for security issues.
+      - name: Docker Scan
+        uses: Checkmarx/[email protected]
+        with:
+          path: .
+          fail_on: high,medium
+          output_path: results
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Upload the results of the KICS scan as a build artifact.
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: results-dir/results.sarif
+
   test:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -6,3 +6,6 @@
 # Environments
 venv/
 virtualenv/
+
+# Security Artifacts
+results.json

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# Contribution Guide
+
+Contributions in the form of issues and pull requests are welcome. Please read the following guidelines before contributing.
+
+## Pre-commit Hooks
+
+This project uses [pre-commit](https://pre-commit.com/) to run a series of checks before committing code. To install the pre-commit hooks, run the following command:
+
+```bash
+pre-commit install
+```
+
+Run the following command to run the pre-commit hooks on all files:
+
+```bash
+pre-commit run --all-files
+```
+
+## Security Testing
+
+This project uses [KICS](https://docs.kics.io/latest/getting-started/) to scan for security issues in the infrastructure such as the `Dockerfile`. To run the scan, run the following command:
+
+```bash
+docker run -t -v $(pwd):/path checkmarx/kics:latest scan -p /path -o "/path/"
+```
+
+This will generate a `results.json` file as well as print the contents to the console. Any findings above a `low` severity should be addressed before committing code as they will fail the CI pipeline.

Dockerfile

@@ -4,14 +4,19 @@ FROM python:3.11-slim-bullseye
 WORKDIR /opt/workspace
 
 # Install dependencies
-RUN python -m pip install case-utils==0.15.0 PyGithub
+RUN python -m pip install case-utils==0.15.0 PyGithub==2.1.1 --no-cache-dir
 
 # Delete source files now that package has been installed
 WORKDIR /opt/workspace
 
 # Copy in the entrypoint file
 COPY entrypoint.py /opt/workspace/entrypoint.py
 
+# Setup a user with the appropriate permissions
+RUN useradd -ms /bin/bash case &&\
+    chown -R case:case /opt/workspace
+USER case
+
 # Define the base path for the validation path
 ENV CASE_PATH "/opt/json/"
 ENV CASE_VERSION "case-1.2.0"