scan.yml

---
name: Security scan

# Periodically scan production images for security vulnerabilities
on:
  schedule:
    # Once a day at midnight
    - cron: '0 0 * * *'
    # Once an hour
    # - cron: '0 * * * *'
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  # Name of image
  IMAGE_NAME: foo-app
  # Name of org in GHCR Docker repository (must be lowercase)
  IMAGE_OWNER: ${{ github.repository_owner }}
  # IMAGE_OWNER: foo
  # ECR Docker repo org name (may be blank, otherwise must have trailing slash)
  ECR_IMAGE_OWNER: cogini/
  # Tag for release images
  # IMAGE_TAG: ${{ (github.ref == 'refs/heads/main' && 'staging') || (github.ref == 'refs/heads/qa' && 'qa') }}
  IMAGE_TAG: latest
  IMAGE_VER: ${{ github.sha }}
  # Registry for test images
  REGISTRY: ghcr.io/
  # Registry for public images, default is docker.io
  PUBLIC_REGISTRY: ''
  # Give GitHub Actions access to AWS
  AWS_ENABLED: 1
  # AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
  # AWS_ROLE_TO_ASSUME: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/cogini-foo-dev-app-github-action
  # AWS_REGION: us-east-1
  # S3_BUCKET_ASSETS: cogini-foo-app-dev-app-assets
  # CLOUDFRONT_CDN_DISTRIBUTION_ID: XXXX
  # S3_BUCKET_CI: cogini-prod-foo-ci
  # Health check port for app
  APP_PORT: 4000
  # Datadog
  # DD_API_KEY: ${{ secrets.ACTIONS_DD_API_KEY }}
  # DD_ENV: ci
  # DD_TAGS: "environment:ci"
  # MIX_ENV: foo
  ELIXIR_MODULE: PhoenixContainerExample
  ECS_CLUSTER: foo
  ECS_SERVICE: foo-app
  ECS_CONTAINER: foo-app
  ECS_CPU: 256
  ECS_RAM: 2048
  CODEDEPLOY_APPLICATION: foo-app
  CODEDEPLOY_DEPLOYMENT_GROUP: foo-app-ecs
  # CODEDEPLOY_BUCKET: foo-prod-bounce-public-deploy
  TASKDEF: ecs/task-definition.json
  ECS_SERVICE_WORKER: foo-worker
  ECS_CONTAINER_WORKER: foo-worker
  ECS_CPU_WORKER: 256
  ECS_RAM_WORKER: 2048
  TASKDEF_WORKER: ecs/task-definition.worker.json
  APPSPEC: ecs/appspec.yml
  # AWS SSM Parameter Store name prefix
  # AWS_PS_PREFIX: cogini/foo/dev
  # APPSIGNAL_APP_NAME: bounce
  # Name of environment for resources created by Terraform
  # TERRAFORM_ENV: dev
  # TASK_ROLE_ARN: "arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/foo-app"
  # EXECUTION_ROLE_ARN: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/foo-ecs-task-execution-role
  # GitHub Advanced Security, free for open source, otherwise a paid feature
  # https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
  # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
  # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
  GITHUB_ADVANCED_SECURITY: 0
  DEPLOY_DOCKER_HUB: 0
  # Docker
  DOCKER_BUILDKIT: '1'
  COMPOSE_DOCKER_CLI_BUILD: '1'
  COMPOSE_FILE: docker-compose.gha.yml
  DOCKER_FILE: deploy/debian.Dockerfile
jobs:
  setup-matrix:
    name: Set up build matrix
    runs-on: ubuntu-latest
    outputs:
      # Elixir/Erlang/OS combinations for tests
      # Generally this will match prod
      test-matrix: ${{ steps.common-matrix.outputs.result }}
      # Combinations for prod images
      # Used for the final deploy image as well as external tests
      prod-matrix: ${{ steps.prod-matrix.outputs.result }}
      # Combinations to deploy to prod (or staging)
      # Generally this will only be a single variant
      deploy-matrix: ${{ steps.deploy-matrix.outputs.result }}
      # Combinations used to build assets
      # Generally this will only be a single variant
      assets-matrix: ${{ steps.assets-matrix.outputs.result }}
    steps:
      - uses: actions/github-script@v7
        id: common-matrix
        # Specify versions of Erlang, Elixir, and base OS
        # in a combination supported by https://hub.docker.com/r/hexpm/elixir/tags
                # {
                #   os: "alma",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "10",
                #   prod_os_ver: "10"
                # },
                # {
                #   os: "alpine",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "3.21.3",
                #   prod_os_ver: "3.21.3"
                # },
                # {
                #   os: "distroless",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "bookworm-20250630-slim",
                #   prod_os_ver: "bookworm-slim"
                # },
                # {
                #   os: "rocky",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "9",
                #   prod_os_ver: "9"
                # },
                # {
                #   os: "ubuntu",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "jammy-20250619",
                #   prod_os_ver: "jammy"
                # },
                # {
                #   os: "chiseled",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "jammy-20250619",
                #   prod_os_ver: "jammy"
                # },
                # {
                #   os: "ubuntu",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "noble-20250619",
                #   prod_os_ver: "noble"
                # },
        with:
          script: |
            return {
              include: [
                {
                  os: "centos7",
                  elixir: "1.18.4",
                  otp: "28.0.1",
                  build_os_ver: "7",
                  prod_os_ver: "7"
                },
                {
                  os: "debian",
                  elixir: "1.18.4",
                  otp: "28.0.1",
                  build_os_ver: "bookworm-20250630-slim",
                  prod_os_ver: "bookworm-slim"
                },
              ]
            }

      # druzan/setup-matrix is slow, taking about 15 seconds to initialize
      #  - name: Define matrix for test containers
      #    id: test-matrix
      #    uses: druzsan/setup-matrix@v2
      #    with:
      #      matrix: |
      #        include:
      #          - elixir: 1.16.3
      #            otp: 26.2.5
      #            build_os_ver: bullseye-20240513
      #            prod_os_ver: bullseye-slim
      #            os: debian

                # {
                #   os: "alma",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "10",
                #   prod_os_ver: "10"
                # },
                # {
                #   os: "alpine",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "3.21.3",
                #   prod_os_ver: "3.21.3"
                # },
                # {
                #   os: "rocky",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "9",
                #   prod_os_ver: "9"
                # },
                # {
                #   os: "ubuntu",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "jammy-20250619",
                #   prod_os_ver: "jammy"
                # },
                # {
                #   os: "chiseled",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "jammy-20250619",
                #   prod_os_ver: "jammy"
                # },
                # {
                #   os: "ubuntu",
                #   elixir: "1.18.4",
                #   otp: "28.0.1",
                #   build_os_ver: "noble-20250619",
                #   prod_os_ver: "noble"
                # },
      - uses: actions/github-script@v7
        id: prod-matrix
        with:
          script: |
            return {
              include: [
                {
                  os: "debian",
                  elixir: "1.18.4",
                  otp: "28.0.1",
                  build_os_ver: "bookworm-20250630-slim",
                  prod_os_ver: "bookworm-slim"
                },
              ]
            }

      - uses: actions/github-script@v7
        id: deploy-matrix
        with:
          script: |
            return {
              include: [
                {
                  os: "debian",
                  elixir: "1.18.4",
                  otp: "28.0.1",
                  build_os_ver: "bookworm-20250630-slim",
                  prod_os_ver: "bookworm-slim",
                },
              ]
            }

      - uses: actions/github-script@v7
        id: assets-matrix
        # Specify versions of Erlang, Elixir, and base OS
        # in a combination supported by https://hub.docker.com/r/hexpm/elixir/tags
        with:
          script: |
            return {
              include: [
                {
                  os: "debian",
                  elixir: "1.18.4",
                  otp: "28.0.1",
                  build_os_ver: "bookworm-20250630-slim",
                  prod_os_ver: "bookworm-slim",
                },
              ]
            }

  scan:
    name: Security scan prod image
    needs: [setup-matrix]
    permissions:
      id-token: write
      contents: read
      packages: read
      checks: write
      pull-requests: write
      issues: read
      # Upload SARIF report files
      security-events: write
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.setup-matrix.outputs.prod-matrix) }}
    env:
      DOCKER_FILE: deploy/${{ matrix.os }}.Dockerfile
      VAR: ${{ matrix.elixir }}-erlang-${{ matrix.otp }}-${{ matrix.os }}-${{ matrix.build_os_ver }}
    steps:
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull image
        run: docker pull "ghcr.io/${IMAGE_OWNER}/${IMAGE_NAME}:${VAR}${IMAGE_VER}"

      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@0.28.0
        # https://github.com/aquasecurity/trivy-action
        # https://github.com/marketplace/actions/aqua-security-trivy#inputs
        with:
          image-ref: ghcr.io/${{env.IMAGE_OWNER}}/${{env.IMAGE_NAME}}:${{ env.VAR }}${{ env.IMAGE_VER }}
          # exit-code: '1' # fail build
          # ignore-unfixed: true
          # vuln-type: 'os,library'
          # severity: 'CRITICAL,HIGH'
          # cache-dir: /var/cache
          # format: 'sarif'
          format: 'table'
          # format: ${{ env.GITHUB_ADVANCED_SECURITY == 1 && 'sarif' || 'table' }}
          output: 'trivy.sarif'

      - name: Display scan results
        if: ${{ always() && env.GITHUB_ADVANCED_SECURITY == 1 }}
        run: cat trivy-results.sarif | jq .

      - name: Upload Trivy scan results to GitHub Security tab
        if: ${{ always() && env.GITHUB_ADVANCED_SECURITY == 1 }}
        uses: github/codeql-action/upload-sarif@v3
        # Requires GitHub Advanced Security
        # https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
        # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning
        # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
        with:
          sarif_file: 'trivy-results.sarif'
          category: trivy

      - name: Scan image with Grype
        uses: anchore/scan-action@v6
        # https://github.com/marketplace/actions/anchore-container-scan
        id: scan-grype
        with:
          image: ghcr.io/${{env.IMAGE_OWNER}}/${{env.IMAGE_NAME}}:${{ env.VAR }}${{ env.IMAGE_VER }}
          # severity-cutoff: critical
          fail-build: false
          # output-format: 'sarif'
          output-format: table
          # output-format: ${{ env.GITHUB_ADVANCED_SECURITY == 1 && 'sarif' || 'table' }}

      - name: Display scan results
        if: ${{ always() && env.GITHUB_ADVANCED_SECURITY == 1 }}
        run: cat ${{ steps.scan-grype.outputs.sarif }} | jq .

      - name: Upload Grype scan results to GitHub Security tab
        if: ${{ always() && env.GITHUB_ADVANCED_SECURITY == 1 }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan-grype.outputs.sarif }}
          category: grype

      # - name: Scan image with Snyk
      #   # if: github.event_name != 'pull_request'
      #   uses: snyk/actions/docker@master
      #   continue-on-error: true
      #   env:
      #     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      #   with:
      #     command: test
      #     image: ghcr.io/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}:${{ env.VAR }}${{ env.IMAGE_VER }}
      #     args: --file=${{ env.DOCKER_FILE }} --project-name=api