fix(CI): Enforce vulnerability scans on PRs (#1546)

.github/workflows/execution-plan-main.yml

@@ -19,3 +19,10 @@ jobs:
     with:
       trigger: main
     secrets: inherit
+
+  trivy-scan:
+    needs: [execution-plan]
+    uses: ./.github/workflows/trivy-scan.yml
+    with:
+      trigger: main
+    secrets: inherit

.github/workflows/trivy-scan.yml

@@ -49,7 +49,7 @@ jobs:
     - name: Run trivy scan
       run: |
         cd trivy
-        earthly +scan-all --kuberpult_version="$IMAGE_TAG_KUBERPULT"
+        earthly +scan-all --kuberpult_version="$IMAGE_TAG_KUBERPULT" --trigger=${{ inputs.trigger }}
     - name: Archive reports
       uses: actions/upload-artifact@v4
       with:

trivy/Earthfile

@@ -18,18 +18,31 @@ deps:
 scan-all:
     FROM +deps
     ARG --required kuberpult_version
-
+    ARG trigger=""
     ARG VERSION_REPORT_NAME="kuberpult-${kuberpult_version}-reports"
     ARG REPORT_TAR_NAME="${VERSION_REPORT_NAME}.tar.gz"
     RUN mkdir $VERSION_REPORT_NAME
 
-    FOR service IN $SERVICES
-        BUILD +scan-service --service=$service --version=$kuberpult_version
-        COPY (+scan-service/* --service=$service --version=$kuberpult_version) $VERSION_REPORT_NAME/
+    IF [ "$trigger" == "pull-request" ]
+        FOR service IN $SERVICES
+            BUILD +scan-service-pr --service=$service --version=$kuberpult_version
+        END
+    ELSE
+        FOR service IN $SERVICES
+            BUILD +scan-service --service=$service --version=$kuberpult_version
+            COPY (+scan-service/* --service=$service --version=$kuberpult_version) $VERSION_REPORT_NAME/
+        END
+        RUN tar -czf $REPORT_TAR_NAME $VERSION_REPORT_NAME/
+        SAVE ARTIFACT $REPORT_TAR_NAME AS LOCAL $REPORT_TAR_NAME
     END
 
-    RUN tar -czf $REPORT_TAR_NAME $VERSION_REPORT_NAME/
-    SAVE ARTIFACT $REPORT_TAR_NAME AS LOCAL $REPORT_TAR_NAME
+scan-service-pr:
+    FROM +deps
+    ARG --required service
+    ARG --required version
+    CACHE --sharing locked --id trivy-cache /tmp/trivy_cache
+
+    RUN trivy --cache-dir /tmp/trivy_cache --severity HIGH,CRITICAL --exit-code 1 image $IMAGE_REGISTRY/kuberpult-$service:$version
 
 scan-service:
     FROM +deps