feat(ci): add trivy job for security

[jsjoeio]

This PR adds a new job to our CI called trivy which uses trivy-action to scan our code and upload the Trivy scan results to the GitHub Security tab.

Fixes #3177

[jawnsy]

Nice work Joe! ❤️

[codecov]

Codecov Report

Merging #3261 (f1491ec) into main (f8d8ad3) will decrease coverage by 4.12%.
The diff coverage is n/a.

❗ Current head f1491ec differs from pull request most recent head 6d5c603. Consider uploading reports for the commit 6d5c603 to get more accurate results

@@            Coverage Diff             @@
##             main    #3261      +/-   ##
==========================================
- Coverage   51.02%   46.90%   -4.13%     
==========================================
  Files          23       23              
  Lines        1266     1196      -70     
  Branches      286      237      -49     
==========================================
- Hits          646      561      -85     
+ Misses        498      451      -47     
- Partials      122      184      +62     

Impacted Files	Coverage Δ
src/common/util.ts	72.34% <0.00%> (-27.66%)	⬇️
src/node/cli.ts	60.95% <0.00%> (-16.74%)	⬇️
src/node/proxy.ts	66.66% <0.00%> (-11.12%)	⬇️
src/common/http.ts	92.30% <0.00%> (-7.70%)	⬇️
src/browser/register.ts	92.30% <0.00%> (-7.70%)	⬇️
src/node/constants.ts	92.85% <0.00%> (-7.15%)	⬇️
src/node/util.ts	44.56% <0.00%> (-2.38%)	⬇️
src/node/heart.ts	70.37% <0.00%> (-2.05%)	⬇️
src/node/plugin.ts	67.59% <0.00%> (-0.59%)	⬇️
src/node/socket.ts	89.65% <0.00%> (-0.35%)	⬇️
... and 7 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f8d8ad3...6d5c603. Read the comment docs.

[jawnsy]

LGTM! Just some minor thoughts for your consideration

[jsjoeio]

2021-04-29T21:24:34.963Z FATAL scan error: image scan failed: failed analysis: walk dir: failed to analyze file: analyze file (.): unable to open a file (.): unable to read file: read .: is a directory

Hmm time to figure out why this failed 🤔 link to line in logs

[jsjoeio]

Step 7/14 : COPY release-packages/code-server*.deb /tmp/

Turns out the build-docker-image script relies on the release-packages being present 😅 so I refactored it back into ci.yaml since they get built in that workflow.

[jsjoeio]

Okay I finally got it all working thanks to help from @code-asher 🎉

Though it says no vulnerabilities were found 🤔

https://github.com/cdr/code-server/security/code-scanning?query=ref%3Arefs%2Fpull%2F3261%2Fmerge+tool%3ATrivy

[jsjoeio]

Thought maybe the findings were not new? https://github.com/cdr/code-server/pull/3261/checks?check_run_id=2496406312

[jawnsy]

Nice stuff! It looks so easy when it's done :)

[jsjoeio]

Nice stuff! It looks so easy when it's done :)

😂 I know right? With Asher's help, it was a lot easier.

[jsjoeio]

Note: for the trivy-action version I went with the commit SHA.

Using the commit SHA of a released action version is the safest for stability and security.

GitHub Docs