CCM-17525: Implementing Grype Scanning

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,7 +25,7 @@
 - [ ] I have added tests to cover my changes
 - [ ] I have updated the documentation accordingly
 - [ ] This PR is a result of pair or mob programming
-<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
+- [ ] If I have used the 'skip-dependencies-check' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.
 
 ---
 

.github/workflows/cicd-1-pull-request.yaml

@@ -33,8 +33,7 @@ jobs:
       is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
       does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
       pr_number: ${{ steps.pr_exists.outputs.pr_number }}
-      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
-      # skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
+
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -75,27 +74,7 @@ jobs:
             echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
             echo "pr_number=" >> $GITHUB_OUTPUT
           fi
-      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
-      # - name: "Determine if Trivy package scan should be skipped"
-      #   id: skip_trivy
-      #   env:
-      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      #     PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
-      #   run: |
-      #     if [[ -z "$PR_NUMBER" ]]; then
-      #       echo "No pull request detected; Trivy package scan will run."
-      #       echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
-      #       exit 0
-      #     fi
-
-      #     labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
-      #     echo "Labels on PR #$PR_NUMBER: $labels"
 
-      #     if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
-      #       echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
-      #     else
-      #       echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
-      #     fi
       - name: "List variables"
         run: |
           export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
@@ -121,8 +100,6 @@ jobs:
       nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
       pnpm_version: "${{ needs.metadata.outputs.pnpm_version }}"
       python_version: "${{ needs.metadata.outputs.python_version }}"
-      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
-      # skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
       terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
       version: "${{ needs.metadata.outputs.version }}"
     secrets: inherit

.github/workflows/stage-1-commit.yaml

@@ -27,11 +27,6 @@ on:
         description: "Python version, set by the CI/CD pipeline workflow"
         required: true
         type: string
-      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
-      # skip_trivy_package:
-      #   description: "Skip Trivy package scan when true"
-      #   type: boolean
-      #   default: false
       terraform_version:
         description: "Terraform version, set by the CI/CD pipeline workflow"
         required: true
@@ -157,36 +152,7 @@ jobs:
         uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4.0.1
       - name: "Lint Terraform"
         uses: NHSDigital/nhs-notify-shared-modules/.github/actions/lint-terraform@5.0.1
-  #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
-  # trivy-iac:
-  #   name: "Trivy IaC Scan"
-  #   permissions:
-  #     contents: read
-  #   runs-on: ubuntu-latest
-  #   timeout-minutes: 10
-  #   needs: detect-terraform-changes
-  #   if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
-  #   steps:
-  #     - name: "Checkout code"
-  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-  #     - name: "Setup ASDF"
-  #       uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302 # v4.0.0
-  #     - name: "Trivy IaC Scan"
-  #       uses: NHSDigital/nhs-notify-shared-modules/.github/actions/trivy-iac@3.1.2
-  # trivy-package:
-  #   if: ${{ !inputs.skip_trivy_package }}
-  #   name: "Trivy Package Scan"
-  #   permissions:
-  #     contents: read
-  #   runs-on: ubuntu-latest
-  #   timeout-minutes: 10
-  #   steps:
-  #     - name: "Checkout code"
-  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-  #     - name: "Setup ASDF"
-  #       uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302 # v4.0.0
-  #     - name: "Trivy Package Scan"
-  #       uses: NHSDigital/nhs-notify-shared-modules/.github/actions/trivy-package@3.1.2
+
   count-lines-of-code:
     name: "Count lines of code"
     runs-on: ubuntu-latest
@@ -217,7 +183,7 @@ jobs:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: "Scan dependencies"
-        uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-dependencies@4.0.5
+        uses: NHSDigital/nhs-notify-shared-modules/.github/actions/scan-dependencies@5.0.6
         with:
           build_datetime: "${{ inputs.build_datetime }}"
           build_timestamp: "${{ inputs.build_timestamp }}"

.tool-versions

@@ -8,7 +8,6 @@ terraform 1.14.3
 terraform-docs 0.21.0
 vale 3.6.0
 python 3.13.2
-# trivy 0.69.3 - TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
 
 # ==============================================================================
 # The section below is reserved for Docker image versions.

scripts/config/pre-commit.yaml

@@ -17,7 +17,7 @@ repos:
     # -   id: ...
 
   - repo: https://github.com/NHSDigital/nhs-notify-shared-modules
-    rev: 5.0.1
+    rev: 5.0.6
     hooks:
       - id: sort-dictionary
       - id: scan-secrets
@@ -32,3 +32,5 @@ repos:
       - id: generate-terraform-docs
       - id: check-todo-usage
         args: [check=branch]
+      - id: scan-dependencies # make githooks-dependencies
+        stages: [manual]

scripts/init.mk

@@ -40,6 +40,12 @@ githooks-run: # Run git hooks configured in this repository @Operations
 		--config scripts/config/pre-commit.yaml \
 		--all-files
 
+githooks-dependencies: # Run git hook for manually scanning depdencies
+	pre-commit run \
+		--config scripts/config/pre-commit.yaml \
+		--hook-stage manual scan-dependencies \
+		--all-files
+
 _install-dependency: # Install asdf dependency - mandatory: name=[listed in the '.tool-versions' file]; optional: version=[if not listed]
 	echo ${name}
 	asdf plugin add ${name} ||:

scripts/terraform/terraform.mk

@@ -118,11 +118,6 @@ terraform-validate-all: # Validate all Terraform components @Quality
 		fi; \
 	done
 
-#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
-# terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
-# 	# Example: make terraform-sec
-# 	./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
-
 terraform-docs: # Generate Terraform documentation - optional: component=[specific component, or all if omitted] @Quality
 	# Example: make terraform-docs component=mycomp
 	# Example: make terraform-docs (generates for all components)

src/jekyll-devcontainer/src/.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 mcr.microsoft.com/devcontainers/jekyll:2-bullseye
+FROM --platform=linux/amd64 mcr.microsoft.com/devcontainers/jekyll:3.4-bookworm
 LABEL org.opencontainers.image.source=https://github.com/NHSDigital/nhs-notify-repository-template
 
 COPY packages.txt packages.txt