Add docker login for daily scan workflow image scanning (#247)

*Description of changes:*
JavaScript version of this PR:
aws-observability/aws-otel-java-instrumentation#1144

By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice.

Author: liustve

.github/actions/artifacts_build/action.yml

@@ -103,4 +103,5 @@ runs:
       uses: ./.github/actions/image_scan
       with:
         image-ref: ${{ inputs.image_uri_with_tag }}
-        severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+        severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
+        logout: 'true'

.github/actions/image_scan/action.yml

@@ -11,6 +11,11 @@ inputs:
   severity:
     required: true
     description: "List of severities that will cause a failure"
+  logout:
+    required: true
+    description: |
+      Whether to logout of public AWS ECR. Set to 'true' for PR workflows to avoid potential call failures,
+      'false' for daily scans which has a higher bar for passing regularly and specifically wants to sign in.
 
 runs:
   using: "composite"
@@ -22,6 +27,7 @@ runs:
   # ensure we can make unauthenticated call. This is important for making the pr_build workflow run on
   # PRs created from forked repos.
   - name: Logout of public AWS ECR
+    if: inputs.logout == 'true'
     shell: bash
     run: docker logout public.ecr.aws
 
@@ -30,4 +36,4 @@ runs:
     with:
       image-ref: ${{ inputs.image-ref }}
       severity: ${{ inputs.severity }}
-      exit-code: '1'
+      exit-code: '1'

.github/workflows/daily-scan.yml

@@ -66,24 +66,35 @@ jobs:
       - name: Print dependency scan results on failure
         if: ${{ steps.dep_scan.outcome != 'success' }}
         run: less dependency-check-report.html
+      
+      - name: Configure AWS credentials for image scan
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
+          aws-region: ${{ env.AWS_DEFAULT_REGION }}
+
+      - name: Login to Public ECR
+        uses: docker/login-action@v3
+        with:
+          registry: public.ecr.aws
 
-      # TODO: Update image to public once available
       - name: Perform high image scan
         if: always()
         id: high_scan
         uses: ./.github/actions/image_scan
         with:
           image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-node:v0.7.0"
           severity: 'CRITICAL,HIGH'
+          logout: 'false'
 
-      # TODO: Update image to public once available
       - name: Perform low image scan
         if: always()
         id: low_scan
         uses: ./.github/actions/image_scan
         with:
           image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-node:v0.7.0"
           severity: 'MEDIUM,LOW,UNKNOWN'
+          logout: 'false'
 
       - name: Configure AWS Credentials for emitting metrics
         if: always()