Merge pull request #21 from vasac/trivy

Add nightly Trivy scan for main branch

.github/workflows/build-trivy.yaml

@@ -0,0 +1,62 @@
+#
+#  Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved.
+#  DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+#  This code is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU General Public License version 2 only, as
+#  published by the Free Software Foundation.  Oracle designates this
+#  particular file as subject to the "Classpath" exception as provided
+#  by Oracle in the LICENSE file that accompanied this code.
+#
+#  This code is distributed in the hope that it will be useful, but WITHOUT
+#  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+#  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+#  version 2 for more details (a copy is included in the LICENSE file that
+#  accompanied this code).
+#
+#  You should have received a copy of the GNU General Public License version
+#  2 along with this work; if not, write to the Free Software Foundation,
+#  Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+#  Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+#  or visit www.oracle.com if you need additional information or have any
+#  questions.
+#
+
+# ---------------------------------------------------------------------------
+# Coherence Helidon Sock Shop Actions Scheduled Trivy Scan
+# ---------------------------------------------------------------------------
+name: Scheduled Trivy Scan
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'main'
+  schedule:
+    # Every day at midnight
+    - cron: '0 0 * * *'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+#   Checkout the source, we need a depth of zero to fetch all of the history otherwise
+#   the copyright check cannot work out the date of the files from Git.
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+
+    - name: Set up JDK
+      uses: actions/setup-java@v3
+      with:
+        java-version: '17'
+        distribution: 'temurin'
+
+    - name: Run Trivy vulnerability scanner in fs mode
+      uses: aquasecurity/trivy-action@master
+      with:
+        scan-type: 'fs'
+        scan-ref: '.'
+        exit-code: '1'

.github/workflows/trivy-scan-image.yaml

@@ -0,0 +1,55 @@
+#
+#  Copyright (c) 2023 Oracle and/or its affiliates. All rights reserved.
+#  DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+#  This code is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU General Public License version 2 only, as
+#  published by the Free Software Foundation.  Oracle designates this
+#  particular file as subject to the "Classpath" exception as provided
+#  by Oracle in the LICENSE file that accompanied this code.
+#
+#  This code is distributed in the hope that it will be useful, but WITHOUT
+#  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+#  FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+#  version 2 for more details (a copy is included in the LICENSE file that
+#  accompanied this code).
+#
+#  You should have received a copy of the GNU General Public License version
+#  2 along with this work; if not, write to the Free Software Foundation,
+#  Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+#  Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+#  or visit www.oracle.com if you need additional information or have any
+#  questions.
+#
+
+# ---------------------------------------------------------------------------
+# Coherence Helidon Sock Shop Actions Scheduled Trivy Image Scan
+# ---------------------------------------------------------------------------
+name: Scheduled Trivy Images Scan
+on:
+  workflow_dispatch:
+  schedule:
+    # Every day at midnight
+    - cron: '0 0 * * *'
+
+jobs:
+  build:
+    runs-on: ubuntu-20.04
+    strategy:
+      fail-fast: false
+      matrix:
+        package:
+          - carts
+          - catalog
+          - orders
+          - payment
+          - shipping
+          - users
+    steps:
+      - name: Run Trivy vulnerability scanner on ${{ matrix.package }}
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'ghcr.io/oracle/coherence-helidon-sockshop-${{ matrix.package }}:latest'
+          format: 'table'
+          exit-code: '1'

carts/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>io.helidon.applications</groupId>
         <artifactId>helidon-mp</artifactId>
-        <version>3.1.2</version>
+        <version>3.2.0</version>
         <relativePath/>
     </parent>
 
@@ -240,6 +240,7 @@
                                     <jvmFlag>-XX:InitialRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MinRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MaxRAMPercentage=70</jvmFlag>
+                                    <jvmFlag>-Djdk.serialFilter=*;!*</jvmFlag>
                                 </jvmFlags>
                                 <ports>
                                     <port>7001</port>

catalog/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>io.helidon.applications</groupId>
         <artifactId>helidon-mp</artifactId>
-        <version>3.1.2</version>
+        <version>3.2.0</version>
         <relativePath/>
     </parent>
 
@@ -237,6 +237,7 @@
                                     <jvmFlag>-XX:InitialRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MinRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MaxRAMPercentage=70</jvmFlag>
+                                    <jvmFlag>-Djdk.serialFilter=*;!*</jvmFlag>
                                 </jvmFlags>
                                 <ports>
                                     <port>7001</port>

k8s/coherence/carts/app.yaml

@@ -25,6 +25,8 @@ spec:
   jvm:
     memory:
       heapSize: 2g
+    args:
+      - "-Djdk.serialFilter=*;!*"
   coherence:
     metrics:
       enabled: true

k8s/coherence/catalog/app.yaml

@@ -25,6 +25,8 @@ spec:
   jvm:
     memory:
       heapSize: 2g
+    args:
+      - "-Djdk.serialFilter=*;!*"
   coherence:
     metrics:
       enabled: true

k8s/coherence/orders/app.yaml

@@ -25,6 +25,8 @@ spec:
   jvm:
     memory:
       heapSize: 2g
+    args:
+      - "-Djdk.serialFilter=*;!*"
   coherence:
     metrics:
       enabled: true

k8s/coherence/payment/app.yaml

@@ -25,6 +25,8 @@ spec:
   jvm:
     memory:
       heapSize: 2g
+    args:
+      - "-Djdk.serialFilter=*;!*"
   coherence:
     metrics:
       enabled: true

k8s/coherence/shipping/app.yaml

@@ -25,6 +25,8 @@ spec:
   jvm:
     memory:
       heapSize: 2g
+    args:
+      - "-Djdk.serialFilter=*;!*"
   coherence:
     metrics:
       enabled: true

k8s/coherence/users/app.yaml

@@ -25,6 +25,8 @@ spec:
   jvm:
     memory:
       heapSize: 2g
+    args:
+      - "-Djdk.serialFilter=*;!*"
   coherence:
     metrics:
       enabled: true

orders/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>io.helidon.applications</groupId>
         <artifactId>helidon-mp</artifactId>
-        <version>3.1.2</version>
+        <version>3.2.0</version>
         <relativePath/>
     </parent>
 
@@ -248,6 +248,7 @@
                                     <jvmFlag>-XX:InitialRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MinRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MaxRAMPercentage=70</jvmFlag>
+                                    <jvmFlag>-Djdk.serialFilter=*;!*</jvmFlag>
                                 </jvmFlags>
                                 <ports>
                                     <port>7001</port>

payment/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>io.helidon.applications</groupId>
         <artifactId>helidon-mp</artifactId>
-        <version>3.1.2</version>
+        <version>3.2.0</version>
         <relativePath/>
     </parent>
 
@@ -256,6 +256,7 @@
                                     <jvmFlag>-XX:InitialRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MinRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MaxRAMPercentage=70</jvmFlag>
+                                    <jvmFlag>-Djdk.serialFilter=*;!*</jvmFlag>
                                 </jvmFlags>
                                 <ports>
                                     <port>7001</port>

shipping/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>io.helidon.applications</groupId>
         <artifactId>helidon-mp</artifactId>
-        <version>3.1.2</version>
+        <version>3.2.0</version>
         <relativePath/>
     </parent>
 
@@ -255,6 +255,7 @@
                                     <jvmFlag>-XX:InitialRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MinRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MaxRAMPercentage=70</jvmFlag>
+                                    <jvmFlag>-Djdk.serialFilter=*;!*</jvmFlag>
                                 </jvmFlags>
                                 <ports>
                                     <port>7001</port>

users/pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>io.helidon.applications</groupId>
         <artifactId>helidon-mp</artifactId>
-        <version>3.1.2</version>
+        <version>3.2.0</version>
         <relativePath/>
     </parent>
 
@@ -240,6 +240,7 @@
                                     <jvmFlag>-XX:InitialRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MinRAMPercentage=70</jvmFlag>
                                     <jvmFlag>-XX:MaxRAMPercentage=70</jvmFlag>
+                                    <jvmFlag>-Djdk.serialFilter=*;!*</jvmFlag>
                                 </jvmFlags>
                                 <ports>
                                     <port>7001</port>