Setup security workflow that tests CVEs in the docker image on change #234
Description
Currently, our trivy job runs but might not be able to detect CVEs in our docker image prior to publishing it.
For example, while our security workflow passes, trivy image openzipkin/zipkin-gcp:2.3 fails with a high severity issue on alpine packages.
To solve this, let's make a new workflow called security-docker based on the security one.
- before trivy runs in that workflowm, build docker/ directory similar this: https://github.com/openzipkin/zipkin-dependencies/blob/master/.github/workflows/test_readme.yml
- change the trivy part of that workflow to only look at that test docker image and nothing else.
- make sure that security workflow isn't run unless pom or dockerfile changes occurred.
This workflow should fail similar to running ad-hoc. Assuming it does, lets do something similar in the docker-java and docker-alpine repos so that they also run trivy only after building the image.