DevOps Shield - DevSecOps Automation - Create devopsshield-cis-anchore-grype.yml

Author: CalinL

.github/workflows/devopsshield-cis-anchore-grype.yml

@@ -0,0 +1,74 @@
+# Last applied at: Fri, 24 Jan 2025 13:36:34 GMT
+# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
+# https://devopsshield.com
+##############################################################
+# This is a DevOps Shield - Application Security - Code Security Template. 
+
+# This workflow template uses actions that are not certified by DevOps Shield. 
+# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
+
+# Use this workflow template for integrating code security into your pipelines and workflows.
+
+# DevOps Shield Workflow Template Details:
+# ------------------------------------------------------------
+# Code: GH_CIS_ANCHORE_GRYPE
+# Name: Anchore Grype Vulnerability Scan (Container Image Scanning)
+# DevSecOpsControls: CIS
+# Provider: Anchore
+# Categories: Code Scanning, Dockerfile
+# Description: 
+# Anchore Grype is a vulnerability scanner for container images and filesystems. 
+# Scan the contents of a container image or filesystem to find known vulnerabilities.
+# Anchore container analysis and scan provided as a GitHub Action.
+# This workflow checks out code, builds an image, performs a container image vulnerability scan with Anchore's Grype tool, 
+# and integrates the results with GitHub Advanced Security code scanning feature.
+# Read the official documentation to find out more. 
+# For more information: 
+# https://github.com/anchore/grype
+# ------------------------------------------------------------
+# Source repository: https://github.com/anchore/scan-action
+##############################################################
+
+name: Anchore Grype Vulnerability Scan (Container Image Scanning)
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: 0 0 * * 0
+
+jobs:
+  anchore-grype-scan:
+    name: Anchore Grype Vulnerability Scan
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    steps:      
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Build an image from Dockerfile
+      uses: docker/build-push-action@v4
+      with:
+        tags: localbuild/testimage:latest
+        push: false
+        load: true
+
+    - name: Run the Anchore Grype scan action
+      uses: anchore/scan-action@v6
+      id: scan
+      with:
+        image: "localbuild/testimage:latest"
+        fail-build: true
+        severity-cutoff: critical
+    - name: Upload Anchore vulnerability report to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: ${{ steps.scan.outputs.sarif }}