security-scan.yml

name: docker security scan

on: [push, pull_request]

# example of how to restrict to one branch and push event
#on:
#  push:
#    branches:
#      - test_branch

env:
  USE_TESTING_TIMEOUTS: "true"
  OPENSTUDIO_VERSION: 3.9.0
  OPENSTUDIO_VERSION_SHA: a000d0ea29
  OPENSTUDIO_VERSION_EXT: "-rc3"
  DOCKER_COMPOSE_VERSION: 1.21.1
  BUNDLE_WITHOUT: native_ext


jobs:
  docker-scan:
    runs-on: ubuntu-22.04
    steps: 
    - name: Check out repository
      uses: actions/checkout@v2
    - name: setup
      shell: bash 
      run: ./ci/github-actions/setup.sh
      env:
        BUILD_TYPE: docker
    - name: docker
      shell: bash 
      run: |
          export OPENSTUDIO_TAG=3.9.0
          sed -i -E "s/.git//g" .dockerignore
          docker volume create --name=osdata
          docker images --all
          docker --version
          docker-compose --version
          docker-compose -f docker-compose.test.yml build --build-arg OPENSTUDIO_VERSION=$OPENSTUDIO_TAG web 
      env: 
        CI: true
        OS_SERVER_NUMBER_OF_WORKERS: 4
        BUILD_TYPE: docker
        COMPOSE_INTERACTIVE_NO_CLI: 1
    - name: Cleanup Docker resources and space
      shell: bash
      run: |
          sudo rm -rf /usr/share/dotnet
          sudo rm -rf /opt/ghc
          sudo rm -rf "/usr/local/share/boost"
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
    - name: Run docker vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        # the image should have been built and tagged in the previous steps
        image-ref: 'nrel/openstudio-server:latest'
        format: 'template'
        template: '@/contrib/sarif.tpl'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH'
        timeout: 15m0s
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Upload container scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: 'trivy-results.sarif'