Merge pull request #397 from sir-gon/develop

Develop

Author: sir-gon

.github/workflows/docker-image.yml

@@ -157,7 +157,7 @@ jobs:
         with:
           sarif_file: 'snyk.sarif'
   scan:
-    name: "Trivy"
+    name: "Trivy (sarif)"
     runs-on: ubuntu-latest
     needs: build
     permissions:
@@ -187,3 +187,25 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: 'trivy-results.sarif'
+
+  report:
+    name: "Trivy (report)"
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ env.ARTIFACT_NAME }}_prod
+          path: /tmp/
+
+      - name: Load image
+        run: |
+          docker load --input /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
+          docker image ls -a
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
+          format: 'table'

Dockerfile

@@ -2,6 +2,7 @@
 FROM node:22.5.1-alpine3.20 AS base
 
 RUN apk add --update --no-cache make
+RUN apk upgrade --update --no-cache openssl libcrypto3 libssl3 # FIX CVE-2024-5535
 
 ENV WORKDIR=/app
 WORKDIR ${WORKDIR}