Add trivy

[zmraul]

Test trivy action

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[carlcsaposs-canonical]

@paulomach is this PR relevant today (given that it's from 2023-11)?

if so:
is there documentation somewhere about:

• what we're trying to accomplish with this
• who will be responsible for monitoring alerts & how they will do that
  ?

also, would it be possible rebase this PR so that trivy is added to the reusable workflows?

[paulomach]

@paulomach is this PR relevant today (given that it's from 2023-11)?

I believe it is. The fact that it's old is about us missing it, instead of it not being important.

if so: is there documentation somewhere about:

* what we're trying to accomplish with this

Ensuring the rock is up-to-date for CVE. Nowadays we are just rebuilding it on our need (e.g. outdated snap) and not when some of the content has vulnerability

* who will be responsible for monitoring alerts & how they will do that
  ?

The duty engineer. Trivy alers will be shown on repo's security report

also, would it be possible rebase this PR so that trivy is added to the reusable workflows?

That's not a bad idea, since all rocks would benefit. @zmraul want to venture on that?

[carlcsaposs-canonical]

I believe other teams may be working on other solutions in parallel that are more aligned with other future plans

and that we may be duplicating their efforts here

[taurus-forever]

Will talk Enrico the next week. AFAIK BigData uses Trivy.... and maybe we should add it to dpw.

P.S. we need to retriger it at least:
https://github.com/canonical/charmed-mysql-rock/actions/runs/6809760169/job/18516809933

The logs for this run have expired and are no longer available.

[taurus-forever]

@paulomach should we also bump mysql in rock? https://github.com/canonical/charmed-mysql-rock/actions/runs/10424799108/job/28874336111

[paulomach]

@paulomach should we also bump mysql in rock? https://github.com/canonical/charmed-mysql-rock/actions/runs/10424799108/job/28874336111

yep

[taurus-forever]

Trivy is not willing to fly :-( https://github.com/canonical/charmed-mysql-rock/actions/runs/10425483416/job/28876474051?pr=35

[zmraul]

To make trivy work, these are the minimal steps needed:

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'trivy/charmed-mysql:test'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'MEDIUM,HIGH,CRITICAL'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

Where image-ref points to a locally uploaded image. The way the CI workflows are setup now on the repo are completely different from when I initially opened the PR, so the way we get the image artifact needs to be updated.