change security scanning so PR pipelines only error on vulnerabilitie…

…s introduced in the PR

.github/workflows/build-images-from-branch.yml

@@ -15,10 +15,14 @@ on:
         description: Branch to build from
         default: develop
         required: true
-  push:
+  pull_request:
     branches-ignore:
       - 'dependabot/**'
       - 'renovate/**'
+  push:
+    branches:
+      - develop
+      - main
 jobs:
   base:
     runs-on: ubuntu-22.04
@@ -29,7 +33,7 @@ jobs:
           ref: '${{ github.event.inputs.branch_name }}'
 
       - uses: actions/checkout@v4
-        if: github.event_name == 'push'
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
 
       - name: Set version and branch
         id: set-version-and-branch
@@ -38,6 +42,8 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           if [ "${{ github.event_name }}" == 'push' ]; then
             BRANCH=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          elif [ "${{ github.event_name }}" == 'pull_request' ]; then
+            BRANCH=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
           else
             BRANCH=${{ inputs.branch_name }}
           fi
@@ -90,7 +96,7 @@ jobs:
           ref: '${{ github.event.inputs.branch_name }}'
 
       - uses: actions/checkout@v4
-        if: github.event_name == 'push'
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
@@ -113,11 +119,53 @@ jobs:
           cache-from: type=registry,ref=opencrvs/ocrvs-${{ matrix.service }}:${{ needs.base.outputs.branch }}
           cache-to: type=inline
 
+  security-scans-pr:
+    needs: [build, base]
+    runs-on: ubuntu-22.04
+    if: github.event_name == 'pull_request'
+    strategy:
+      matrix:
+        service: ${{ fromJSON(needs.base.outputs.services) }}
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: 'opencrvs/ocrvs-${{ matrix.service }}:${{ github.event.pull_request.base.ref }}'
+          trivy-config: trivy.yaml
+          format: 'sarif'
+          output: './trivy-results-base.sarif'
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: 'opencrvs/ocrvs-${{ matrix.service }}:${{ needs.base.outputs.version }}'
+          trivy-config: trivy.yaml
+          format: 'sarif'
+          output: './trivy-results-branch.sarif'
+
+      - name: Remove lines that are always expected to be different
+        run: |
+          sed -i '/"uri": "file:\/\/\/github\/workspace\/base\//d' ${{ github.workspace }}/trivy-results-base.sarif
+          sed -i '/"uri": "file:\/\/\/github\/workspace\/branch\//d' ${{ github.workspace }}/trivy-results-branch.sarif
+
+      - name: Diff Trivy results
+        run: diff -u ./trivy-results-base.sarif ./trivy-results-branch.sarif
+
+  security-scans-develop:
+    needs: [build, base]
+    runs-on: ubuntu-22.04
+    if: ${{ needs.base.outputs.branch == 'develop' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        service: ${{ fromJSON(needs.base.outputs.services) }}
+    steps:
       - name: Run Trivy vulnerability scanner
-        # Skip temporarily for non-develop branches because of
-        # a TOOMANYREQUESTS error failing the check
-        # https://github.com/aquasecurity/trivy/discussions/7591
-        uses: aquasecurity/trivy-[email protected]
+        uses: aquasecurity/[email protected]
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
+          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
         with:
           image-ref: 'opencrvs/ocrvs-${{ matrix.service }}:${{ needs.base.outputs.version }}'
           trivy-config: trivy.yaml
+          github-pat: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lint-and-test.yml

@@ -137,16 +137,3 @@ jobs:
       - name: Run Unit Test
         if: steps.check-scripts.outputs.skip != 'true' && steps.check-scripts.outputs.skip-test != 'true'
         run: cd ${{ matrix.package }} && yarn test
-
-  security-scans:
-    needs: setup
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Run Trivy vulnerability scanner in fs mode
-        uses: aquasecurity/[email protected]
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          trivy-config: trivy.yaml

.github/workflows/publish-release.yml

@@ -102,7 +102,11 @@ jobs:
             .trivyignore.yaml
           sparse-checkout-cone-mode: false
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/[email protected]
+        uses: aquasecurity/[email protected]
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
+          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
         with:
           image-ref: 'opencrvs/ocrvs-${{ matrix.service }}:${{ needs.base.outputs.version }}'
           trivy-config: trivy.yaml
+          github-pat: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-scans.yml

@@ -0,0 +1,82 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# OpenCRVS is also distributed under the terms of the Civil Registration
+# & Healthcare Disclaimer located at http://opencrvs.org/license.
+#
+# Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
+name: Scan files for vulnerabilities
+
+on:
+  push:
+    branches:
+      - develop
+  pull_request:
+
+jobs:
+  security-scan-development:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Run Trivy vulnerability scanner in fs mode
+        uses: aquasecurity/[email protected]
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
+          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
+        with:
+          github-pat: ${{ secrets.GITHUB_TOKEN }}
+          scan-type: 'fs'
+          scan-ref: '.'
+          trivy-config: trivy.yaml
+
+  security-scan-pull-request:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          path: 'base'
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          path: 'branch'
+
+      - name: Run Trivy vulnerability scanner in fs mode
+        uses: aquasecurity/[email protected]
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
+          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
+        with:
+          github-pat: ${{ secrets.GITHUB_TOKEN }}
+          scan-type: 'fs'
+          scan-ref: 'base'
+          trivy-config: ./base/trivy.yaml
+          format: 'sarif'
+          output: './trivy-results-base.sarif'
+
+      - name: Run Trivy vulnerability scanner in fs mode
+        uses: aquasecurity/[email protected]
+        env:
+          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
+          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
+        with:
+          github-pat: ${{ secrets.GITHUB_TOKEN }}
+          scan-type: 'fs'
+          scan-ref: 'branch'
+          trivy-config: ./branch/trivy.yaml
+          format: 'sarif'
+          output: './trivy-results-branch.sarif'
+
+      - name: Remove lines that are always expected to be different
+        run: |
+          sed -i '/"uri": "file:\/\/\/github\/workspace\/base\//d' ${{ github.workspace }}/trivy-results-base.sarif
+          sed -i '/"uri": "file:\/\/\/github\/workspace\/branch\//d' ${{ github.workspace }}/trivy-results-branch.sarif
+
+      - name: Diff Trivy results
+        run: diff -u ./trivy-results-base.sarif ./trivy-results-branch.sarif

trivy.yaml

@@ -26,5 +26,3 @@ scan:
 ignorefile: .trivyignore.yaml
 vulnerability:
   ignore-unfixed: true
-db:
-  repository: 'public.ecr.aws/aquasecurity/trivy-db'