add trivy，gosec scan

.github/workflows/period-check.yml

@@ -16,6 +16,10 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+      - name: Run gosec security scan
+        run: |
+          curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s latest
+          gosec -severity high -confidence high ./... || exit 1
       - name: e2e test
         env:
           E2E_TESTING_LEVEL: "periodCheck"

.github/workflows/pr.yml

@@ -20,6 +20,10 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+      - name: Run gosec security scan
+        run: |
+          curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s latest
+          gosec -severity high -confidence high ./... || exit 1
       - name: pr test
         env:
           E2E_TESTING_LEVEL: "pr-e2e"

Makefile

@@ -232,7 +232,7 @@ DOCKER_MAKE_CMD = docker run --rm -v ${PROJECT_SOURCE_CODE_DIR}:${BUILDER_MOUNT_
 DOCKER_BUILDX_CMD_AMD64 = DOCKER_CLI_EXPERIMENTAL=enabled docker buildx build --platform=linux/amd64 -o type=docker
 DOCKER_BUILDX_CMD_ARM64 = DOCKER_CLI_EXPERIMENTAL=enabled docker buildx build --platform=linux/arm64 -o type=docker
 RELEASE_TAG ?= $(shell tagged="$$(git describe --tags --match='v*' --abbrev=0 2> /dev/null)"; if [ "$$tagged" ] && [ "$$(git rev-list -n1 HEAD)" = "$$(git rev-list -n1 $$tagged)" ]; then echo $$tagged; fi)
-MUILT_ARCH_PUSH_CMD = ${PROJECT_SOURCE_CODE_DIR}/docker-push-with-multi-arch.sh
+MUILT_ARCH_PUSH_CMD = ${PROJECT_SOURCE_CODE_DIR}/build/util/docker-push-with-multi-arch.sh
 
 .PHONY: compile
 compile: ## compile

build/util/scan-image-with-trivy.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+image_name=$1
+arch_list=("amd64" "arm64")
+severity="CRITICAL"
+e_code=${2:-0}
+
+# install trivy
+{ which trivy 2>/dev/null; } || { echo "install trivy now..."; curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin latest; }
+
+for arch in ${arch_list[@]}
+do
+    img_of_cur_arch=${image_name}-${arch}
+    echo "# scan image for ${img_of_cur_arch}"
+
+    # check image
+    set +e
+    docker inspect ${img_of_cur_arch} 2>&1 > /dev/null
+    if [ $? -ne 0 ]; then
+        echo "[Warning] No ${arch} image found on local , image name is ${img_of_cur_arch}. aborting  image manifest merge"
+        exit 2
+    fi
+    set -e
+    # scan image
+    echo "# scaning image ${image_name}..."
+    trivy image ${img_of_cur_arch} --severity ${severity} --exit-code ${e_code}
+
+    # report
+    echo "# scan successfully for image ${image_name}. No $severity level vulnerabilities found to be fixed."
+done