Implement a security scanner in the repository

[Michaelpalacce]

Description

A suggestion is to use trivy it's free and works pretty well.

Running it locally like so: trivy fs --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed --skip-dirs "**/target/*" . provides a lot of information about potential issues, most of which are fixed with newer versions of packages.

How To Integrate

Suggestion is to detect changes done in the current PR and fail the build if PR changes have a HIGH or CRITICAL vulnerability (Up for debate, CRITICAL may be enough).

This is how you can generate a report for a specific directory, works with a file too

trivy fs --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed --skip-dirs "**/target/*" --scanners vuln,secret,misconfig  common/artifact-manager/src/main/java/com/vmware/pscoe/iac/artifact

Trivy supports --format github that can later be published to github "Security" tab, check out: https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning for more info

Github Action

Potentially this can be used to fullfil the abovementioned requirements

report.log

[Michaelpalacce]

We want to integrate the trivy scanner GitHub action and report security vulnerabilities to GitHub Code Scanning (check this and this)