Remove Java artifacts scanning from vulnerability scans [DI-50]

.github/workflows/vulnerability_scan_subworkflow.yml

@@ -1,78 +1,33 @@
 name: Vulnerability Scan
 
 on:
-    workflow_call:
-        inputs:
-            ref:
-                required: true
-                type: string
-        secrets:
-            SNYK_TOKEN:
-                required: true
-    workflow_dispatch:
-        inputs:
-            ref:
-                required: true
-                type: string
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+    secrets:
+      SNYK_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      ref:
+        required: true
+        type: string
 
 jobs:
-  scan-oss:
-    env:
-      DOCKLE_HOST: "unix:///var/run/docker.sock"
+  scan:
     runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code at ${{ inputs.ref }} branch
-        uses: actions/checkout@v4
-        with:
-            ref: ${{ inputs.ref }}
-
-      - name: Install xmllint
-        uses: ./.github/actions/install-xmllint
-
-      - name: Get OSS dist ZIP
-        run: |
-          . .github/scripts/oss-build.functions.sh
-          HZ_VERSION=$(awk -F '=' '/^ARG HZ_VERSION=/ {print $2}' hazelcast-oss/Dockerfile)
-          export HZ_SNAPSHOT_INTERNAL_PASSWORD=${{ secrets.HZ_SNAPSHOT_INTERNAL_PASSWORD }}
-          export HZ_SNAPSHOT_INTERNAL_USERNAME=${{ secrets.HZ_SNAPSHOT_INTERNAL_USERNAME }}
-          HAZELCAST_OSS_ZIP_URL=$(get_hz_dist_zip "" "${HZ_VERSION}")        
-          curl --fail --silent --show-error --location "$HAZELCAST_OSS_ZIP_URL" --output hazelcast-oss/hazelcast-distribution.zip;
-
-      - name: Build OSS image
-        run: |
-            docker build -t hazelcast/oss:${{ github.sha }} hazelcast-oss
-
-      - name: Scan OSS image by Trivy
-        if: always()
-        uses: aquasecurity/[email protected]
-        with:
-          image-ref: hazelcast/oss:${{ github.sha }}
-          trivy-config: .github/containerscan/trivy.yaml
-
-      - name: Scan OSS image by Dockle
-        if: always()
-        uses: goodwithtech/dockle-action@main
-        with:
-          image: hazelcast/oss:${{ github.sha }}
-          format: 'list'
-          exit-code: '1'
-          exit-level: 'warn'
-          # too many false positives, we don't use credentials in Dockerfile
-          ignore: 'CIS-DI-0010'
-
-      - name: Scan OSS image by Snyk
-        if: always()
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: hazelcast/oss:${{ github.sha }}
-          args: --file=hazelcast-oss/Dockerfile --policy-path=.github/containerscan --severity-threshold=high --exclude-base-image-vulns
-
-  scan-ee:
+    strategy:
+      matrix:
+        image:
+          - label: oss
+            distribution_zip_name: hazelcast-distribution.zip
+          - label: enterprise
+            distribution_zip_name: hazelcast-enterprise-distribution.zip
     env:
-      DOCKLE_HOST: "unix:///var/run/docker.sock"
-    runs-on: ubuntu-latest
+      DIRECTORY: hazelcast-${{ matrix.image.label }}
+      IMAGE_TAG: hazelcast/${{ matrix.image.label }}:${{ github.sha }}
     steps:
       - name: Checkout Code at ${{ inputs.ref }} branch
         uses: actions/checkout@v4
@@ -82,40 +37,49 @@ jobs:
       - name: Install xmllint
         uses: ./.github/actions/install-xmllint
 
-      - name: Get EE dist ZIP
+      - name: Generate ${{ matrix.image.label }} dist ZIP
         run: |
-          . .github/scripts/ee-build.functions.sh
-          HZ_VERSION=$(awk -F '=' '/^ARG HZ_VERSION=/ {print $2}' hazelcast-enterprise/Dockerfile)          
-          HAZELCAST_EE_ZIP_URL=$(get_hz_dist_zip "" "${HZ_VERSION}")        
-          curl --fail --silent --show-error --location "$HAZELCAST_EE_ZIP_URL" --output hazelcast-enterprise/hazelcast-enterprise-distribution.zip;
+          # Make a dummy empty ZIP file to avoid scanning Java dependencies, as managed downstream
+          # DI-50 - Remove java artifacts scanning from hazelcast-docker
+          working_directory=hazelcast-distribution
+          mkdir -p ${working_directory}/lib
+          mkdir -p ${working_directory}/bin
+          touch ${working_directory}/bin/empty
 
-      - name: Build EE image
+          zip -r ${{ env.DIRECTORY }}/${{ matrix.image.distribution_zip_name }} ${working_directory}
+
+      - name: Build ${{ matrix.image.label }} image
         run: |
-          docker build -t hazelcast/ee:${{ github.sha }} hazelcast-enterprise
+          docker build -t ${{ env.IMAGE_TAG }} ${{ env.DIRECTORY }}
 
-      - name: Scan EE image by Trivy
+      - name: Scan ${{ matrix.image.label }} image by Trivy
         if: always()
         uses: aquasecurity/[email protected]
         with:
-          image-ref: hazelcast/ee:${{ github.sha }}
+          image-ref: ${{ env.IMAGE_TAG }} 
           trivy-config: .github/containerscan/trivy.yaml
+        env:
+          # https://github.com/aquasecurity/trivy/issues/2432
+          DOCKLE_HOST: "unix:///var/run/docker.sock"
 
-      - name: Scan EE image by Dockle
+      - name: Scan ${{ matrix.image.label }} image by Dockle
         if: always()
-        uses: goodwithtech/dockle-action@main
+        # Use our fork until https://github.com/goodwithtech/dockle-action/issues/7 is fixed
+        # uses: goodwithtech/dockle-action@main
+        uses: hazelcast/dockle-action/@Upgrade-Dockle-to-`0.4.14`
         with:
-          image: hazelcast/ee:${{ github.sha }}
+          image: ${{ env.IMAGE_TAG }} 
           format: 'list'
           exit-code: '1'
           exit-level: 'warn'
           # too many false positives, we don't use credentials in Dockerfile
           ignore: 'CIS-DI-0010'
 
-      - name: Scan EE image by Snyk
+      - name: Scan ${{ matrix.image.label }} image by Snyk
         if: always()
         uses: snyk/actions/docker@master
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
-          image: hazelcast/ee:${{ github.sha }}
-          args: --file=hazelcast-enterprise/Dockerfile --policy-path=.github/containerscan --severity-threshold=high --exclude-base-image-vulns
+          image: ${{ env.IMAGE_TAG }} 
+          args: --file=${{ env.DIRECTORY }}/Dockerfile --policy-path=.github/containerscan --severity-threshold=high --exclude-base-image-vulns