Add Trivy vulnerability scanning for Docker images

.github/dependabot.yml

@@ -0,0 +1,28 @@
+# The contents of this file are subject to the terms of the Common Development and
+# Distribution License (the License). You may not use this file except in compliance with the
+# License.
+#
+# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+# specific language governing permission and limitations under the License.
+#
+# When distributing Covered Software, include this CDDL Header Notice in each file and include
+# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+# Header, with the fields enclosed by brackets [] replaced by your own identifying
+# information: "Portions copyright [year] [name of copyright owner]".
+#
+# Copyright 2026 3A Systems, LLC.
+version: 2
+updates:
+  # Keeps the SHA-pinned third-party actions in .github/workflows up to date: Dependabot
+  # bumps the commit hash and the trailing "# vX.Y.Z" version comment together.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      # One pull request per week for all action updates instead of one per action.
+      github-actions:
+        patterns: ["*"]
+    labels:
+      - "ci"
+      - "dependencies"

.github/workflows/build.yml

@@ -1,3 +1,16 @@
+# The contents of this file are subject to the terms of the Common Development and
+# Distribution License (the License). You may not use this file except in compliance with the
+# License.
+#
+# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+# specific language governing permission and limitations under the License.
+#
+# When distributing Covered Software, include this CDDL Header Notice in each file and include
+# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+# Header, with the fields enclosed by brackets [] replaced by your own identifying
+# information: "Portions copyright [year] [name of copyright owner]".
+#
+# Portions Copyright 2026 3A Systems, LLC.
 name: Build 
 
 on:
@@ -51,12 +64,20 @@ jobs:
   build-docker:
     needs: build-maven
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: read
+      # upload of the Trivy scan results to code scanning
+      security-events: write
     services:
       registry:
         image: registry:2
         ports:
           - 5000:5000
     steps:
+      - uses: actions/checkout@v7
+        with:
+          # no git command here needs the token; upload-sarif takes it through its own input
+          persist-credentials: false
       - name: Download artifacts
         uses: actions/download-artifact@v8
         with:
@@ -66,6 +87,7 @@ jobs:
         run:   |
           export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenIG/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
           echo "release_version=$git_version_last" >> $GITHUB_ENV
+          echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v6
@@ -101,3 +123,39 @@ jobs:
         run: |
           docker run --rm -it -d --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
           timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'
+      - name: Install Trivy
+        # cached, unlike the DBs: trivy-action's `cache: false` would also skip the binary
+        # cache and leave an anonymous github.com release lookup in every run
+        continue-on-error: true
+        uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
+        with:
+          version: v0.70.0
+          cache: true
+      - name: Scan image for vulnerabilities (Trivy)
+        # trivy resolves the image from the local Docker daemon, so only the runner's
+        # linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
+        # evicting the m2-repository caches out of the repo's 10GB actions-cache quota.
+        # Findings do not fail the step; a Trivy or trivy-db registry outage does, and must
+        # not fail the job: a red Build skips the snapshot deploy in deploy.yml. The step
+        # timeout also bounds the Java DB download, which trivy's own --timeout does not
+        continue-on-error: true
+        timeout-minutes: 15
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          skip-setup-trivy: true
+          image-ref: localhost:5000/${{ env.image_repository }}:${{ env.release_version }}
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          limit-severities-for-sarif: true
+          ignore-unfixed: true
+          scanners: vuln
+          cache: false
+      - name: Upload Trivy report to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        # upload even if a preceding step failed, but not on a cancelled run or without a report to upload
+        if: ${{ !cancelled() && hashFiles('trivy-results.sarif') != '' }}
+        with:
+          sarif_file: trivy-results.sarif
+          # distinct from the docker-scan.yml category, which tracks the published image
+          category: trivy-build-default

.github/workflows/docker-scan.yml

@@ -0,0 +1,78 @@
+# The contents of this file are subject to the terms of the Common Development and
+# Distribution License (the License). You may not use this file except in compliance with the
+# License.
+#
+# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+# specific language governing permission and limitations under the License.
+#
+# When distributing Covered Software, include this CDDL Header Notice in each file and include
+# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+# Header, with the fields enclosed by brackets [] replaced by your own identifying
+# information: "Portions copyright [year] [name of copyright owner]".
+#
+# Copyright 2026 3A Systems, LLC.
+
+# Scans the published Docker image for known vulnerabilities: new CVEs surface in
+# already-released images (mostly via the base image), without any change in this repository.
+# Its trivy-image-latest category exists only on master, so once it has run, every PR that
+# uploads trivy-build-default gets a "Trivy" check that concludes neutral with
+# "1 configuration not found".
+name: Docker Scan
+
+on:
+  schedule:
+    - cron: '30 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    # Do not run the scheduled scan in forks; manual runs are always allowed.
+    if: github.event_name == 'workflow_dispatch' || github.repository == 'OpenIdentityPlatform/OpenIG'
+    runs-on: ubuntu-latest
+    # trivy's own --timeout bounds neither the Java DB download nor the Trivy install
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        tag: [ 'latest' ]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # no git command here needs the token; upload-sarif takes it through its own input
+          persist-credentials: false
+      - name: Install Trivy
+        # cached, unlike the DBs: trivy-action's `cache: false` would also skip the binary
+        # cache and leave an anonymous github.com release lookup in every run. Unlike in
+        # build.yml, a failure here fails the job: a failed scan is what this workflow reports
+        uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
+        with:
+          version: v0.70.0
+          cache: true
+      - name: Scan openidentityplatform/openig:${{ matrix.tag }} (Trivy)
+        # unlike the build.yml scan (ignore-unfixed: true), unfixed CVEs are reported too:
+        # surfacing them in already-released images is the point of this workflow. Trivy pulls
+        # only the linux/amd64 manifest (no --platform is passed); the other published
+        # platforms (arm64, ppc64le, s390x) are not scanned
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          skip-setup-trivy: true
+          image-ref: openidentityplatform/openig:${{ matrix.tag }}
+          format: sarif
+          output: trivy-${{ matrix.tag }}.sarif
+          severity: CRITICAL,HIGH
+          limit-severities-for-sarif: true
+          scanners: vuln
+          cache: false
+      - name: Upload report to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        # upload even if a preceding step failed, but not on a cancelled run or without a report to upload
+        if: ${{ !cancelled() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
+        with:
+          sarif_file: trivy-${{ matrix.tag }}.sarif
+          category: trivy-image-${{ matrix.tag }}