ci: add reusable container scan workflow (Trivy)

[ulziibay-kernel]

Summary

• Adds container-scan.yml reusable workflow for Trivy-based container image scanning
• Scans OS packages + application dependencies in built images (the layer Semgrep and Socket SCA don't cover)
• Uploads SARIF to GitHub Security tab for unified findings view
• Supports ECR images via OIDC role assumption

Context

Satisfies SOC 2 VPM-2 (quarterly vulnerability scans on external-facing systems) with every-deploy cadence. This is item 13 in the AWS evidence assessment.

Uses Trivy directly because Socket Basics' pre-built GitHub Action image temporarily ships without Trivy (v2.0.3). Workflow includes a comment documenting the swap path when Socket re-enables it.

Consumer usage

container-scan:
  needs: build-and-push-image
  uses: kernel/security-workflows/.github/workflows/container-scan.yml@main
  with:
    image-ref: '613957054632.dkr.ecr.us-east-1.amazonaws.com/kernel/api:sha-${{ needs.build-and-push-image.outputs.short-sha }}'
    ecr-role-to-assume: ${{ vars.ECR_PUSHER }}
    exit-code: '0'  # observe-only initially
  secrets: inherit

Test plan

• Verify workflow syntax is valid (Actions tab)
• Test from kernel/kernel api-build workflow pointing at this branch
• Confirm SARIF uploads to Security tab
• Confirm ECR login works with OIDC role

Made with Cursor

[firetiger-agent]

Created a monitoring plan for this PR.

What this PR does: Adds automated container image vulnerability scanning (Trivy) to every deploy, with findings surfaced in the GitHub Security tab — satisfying the SOC 2 VPM-2 quarterly scan requirement at every-deploy cadence.

Intended effect:

• Container Scan workflow registration: baseline 0 (new workflow); confirmed if gh workflow list --repo kernel/security-workflows shows "Container Scan" as active within 5 minutes of merge
• First consumer invocation: baseline none (no prior runs); confirmed if the first container-scan / scan job in a consuming repo (e.g. kernel/kernel api-build) concludes success
• SARIF upload to Security tab: baseline none; confirmed if findings appear under Security > Code Scanning in the consuming repo after the first run
• Existing Vulnerability Remediation Self-Test: baseline 100% success rate (all 50 runs May 28–Jun 10); confirmed if no regression after merge

Risks:

• ECR OIDC login failure — container-scan / scan job concludes failure with "Configure AWS credentials" or "Log in to ECR" step failing; alert if first consumer invocation fails this step
• Floating @master Trivy action breaks — "Scan container image" step fails on a run that previously passed; alert if any Container Scan job concludes failure after a prior success
• Workflow not registered on merge — "Container Scan" absent from gh workflow list within 5 minutes of merge; alert if workflow is missing or disabled
• Regression in existing workflows — Vulnerability Remediation Self-Test concludes failure within 48h of merge; alert on any failure (pre-merge success rate is 100%)

Status updates will be posted automatically on this PR as monitoring progresses.

View monitor

[cursor]

Missing SARIF Security tab upload

Medium Severity

The reusable workflow only emits JSON (trivy-results.json) and a workflow artifact, but the PR promises SARIF upload to the GitHub Security tab. There is no format: sarif scan step or github/codeql-action/upload-sarif, and the job lacks security-events: write, so unified code scanning findings never appear.

 

^{Reviewed by Cursor Bugbot for commit 8e51fc9. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 75b3296. Configure here.}

[cursor]

Fix job requires triage success

Medium Severity

The fix job lists needs: triage with no if that allows triage failure, so a failed or timed-out triage skips remediation entirely. That conflicts with fix-prompt.md, which expects fixes from trivy-results.json when triage output is absent, and leaves scan artifacts unused after triage errors.

Additional Locations (1)

• .github/workflows/container-scan/fix-prompt.md#L15-L17

 

^{Reviewed by Cursor Bugbot for commit 75b3296. Configure here.}