[#291] Added generic scan workflow. (#292)

.github/workflows/vulnerability-scan.yml

@@ -0,0 +1,55 @@
+name: vulnerability-scan
+run-name: Scheduled CVE vulnerability scan of published images.
+env:
+  REGISTRY: ghcr.io
+on:
+  workflow_dispatch:
+    inputs:
+      summary:
+        description: 'Summary of the scheduled scan.'
+        required: false
+        default: 'Trivy CVE scan of published images.'
+jobs:
+  setup-matrix:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set summary
+        run: echo "${{ github.event.inputs.summary }}" >> $GITHUB_STEP_SUMMARY
+      - if: github.ref_name == '5.x'
+        uses: druzsan/setup-matrix@v2
+        with:
+          matrix: |
+            images: ${{ vars.IMAGES }}
+            exclude:
+              - images: mailpit
+      - if: github.ref_name != '5.x'
+        uses: druzsan/setup-matrix@v2
+        with:
+          matrix: |
+            images: ${{ vars.IMAGES }}
+            exclude:
+              - images: mailpit
+      - id: setup-matrix
+        run: echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
+    outputs:
+        matrix: ${{ steps.setup-matrix.outputs.matrix }}
+  vulnerability-scan-schedule:
+    runs-on: ubuntu-latest
+    needs: setup-matrix
+    strategy:
+      matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.ref }}
+      - name: Scan for vulnerabilities
+        id: scan
+        uses: crazy-max/ghaction-container-scan@v3
+        with:
+          image: ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.images }}:${{ github.ref_name }}
+          dockerfile: ./images/${{ matrix.images }}
+      - name: Upload SARIF file
+        if: ${{ steps.scan.outputs.sarif != '' }}
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}

images/php/Dockerfile.cli

@@ -4,7 +4,7 @@ FROM ghcr.io/skpr/mtk:v2.0.2 AS mtk
 FROM uselagoon/php-${PHP_VERSION}-cli-drupal:latest
 
 ARG GOJQ_VERSION=0.12.16
-ARG DOCKERIZE_VERSION=v0.8.0
+ARG DOCKERIZE_VERSION=v0.6.1
 ARG BAY_CLI_VERSION=v1.1.3
 
 COPY --from=php-cli /usr/local/bin/phpdbg /usr/local/bin/