cap08-08-montando-step-de-analise-de-vulnerabilidades

Author: argentinaluiz

.github/workflows/ci.yaml

@@ -12,11 +12,16 @@ env:
   REGISTRY: docker.io
   DOCKER_USERNAME: argentinaluiz
   IMAGE_NAME: argentinaluiz/docker-prod-test
-
+  SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
 jobs:
   ci:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Ler o conteúdo do repositório
+      packages: write # Permitir publicar pacotes no GitHub Packages
+      pull-requests: write # Permitir criar e atualizar pull requests
+      security-events: write # Enviar eventos de segurança para o Github Security
 
     steps:
       - name: Checkout repository
@@ -53,4 +58,44 @@ jobs:
       - name: Run tests
         run: echo "Running tests..."
 
+      - name: Build for analysis
+        id: build-for-analysis
+        uses: docker/[email protected]
+        with:
+          context: ./src/ci/nestjs-project
+          file: ./src/ci/nestjs-project/Dockerfile.prod
+          push: false
+          load: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          secrets: |
+            github_token=${{ secrets.MY_GITHUB_TOKEN }}
+      
+      - name: Analyze for critical and high CVEs
+        id: docker-scout-cves
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
+          only-severities: critical,high
+          only-fixed: true
+          summary: true # publicar github actions e pull request
+          exit-code: true
+      
+      - name: Analyze for all CVEs
+        id: docker-scout-all-cves
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SHA }}
+          summary: true
+          sarif-file: sarif.output.json
 
+      - name: Upload SARIF result
+        id: upload-sarif
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: sarif.output.json
+      

src/ci/nestjs-project/.dockerignore

@@ -22,6 +22,8 @@
 **/*.jfm
 **/charts
 **/docker-compose*
+**/compose.*yml
+**/compose.*yaml
 **/compose.y*ml
 **/Dockerfile*
 **/node_modules

src/ci/nestjs-project/Dockerfile.prod

@@ -1,4 +1,4 @@
-FROM node:23.0.0-slim AS ci
+FROM node:24.9.0-slim AS ci
 
 ARG REPO_PATH=github.com/argentinaluiz/private-repo.git
 
@@ -27,7 +27,7 @@ COPY --chown=node:node . .
 
 CMD [ "tail", "-f", "/dev/null" ]
 
-FROM node:23.0.0-slim AS builder
+FROM node:24.9.0-slim AS builder
 
 ENV NODE_ENV=production
 
@@ -43,7 +43,7 @@ RUN npm run build
 RUN --mount=type=cache,target=/home/node/.npm,uid=1000,gid=1000,id=npm-cache \
     npm ci --only=production
 
-FROM node:23.0.0-slim AS production
+FROM node:24.9.0-slim AS production
 
 ENV NODE_ENV=production
 

src/ci/nestjs-project/compose.ci.yaml

@@ -35,6 +35,7 @@ services:
   postgres:
     image: postgres:15
     environment:
+      POSTGRES_PASSWORD: example
       POSTGRES_DB: db
     ports:
       - 5432:5432