pip prod(deps): bump tox from 3.25.0 to 4.7.0 #4857

	name: Docker build and container scan

	on:
	push:
	branches:
	- '**'

	jobs:
	build:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v2

	- name: Docker build
	run: \|
	docker build . --file ./distribution/docker-images/ci.Dockerfile --tag containerscanner:${{ github.sha }}

	- name: Anchore scan
	uses: anchore/[email protected]
	with:
	image-reference: containerscanner:${{ github.sha }}
	dockerfile-path: ./distribution/docker-images/dev.Dockerfile
	include-app-packages: true
	fail-build: true # no idea why it doesn't work

	- name: Show Anchore results
	run: for j in `ls ./anchore-reports/*.json`; do echo "---- ${j} ----"; cat ${j}; echo; done
	if: ${{ always() }}

	- name: Upload Anchore results
	uses: actions/upload-artifact@v2
	with:
	name: anchore-reports
	path: ./anchore-reports/
	if: ${{ always() }}

	- name: Fail on any vulnerability
	run: jq -e '.vulnerabilities \| any( . ) \| not' anchore-reports/vulnerabilities.json

Provide feedback