Add Anchore Go dependency security scanning

Scan Go dependencies for known vulnerabilities.

Run on PRs to gate on vulns negligible or higher.
Also run on merges to devel and release branches to report results on
the GitHub Code Scanning tab.

Ignore two false positives.

Relates-to: submariner-io/submariner#794
Signed-off-by: Daniel Farrell <[email protected]>

.github/workflows/linting.yml

@@ -113,6 +113,28 @@ jobs:
       - name: Run shellcheck
         run: make shellcheck
 
+  vulnerability-scan:
+    name: Vulnerability Scanning
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+      - name: Run Anchore vulnerability scanner
+        uses: anchore/scan-action@516844f15d82b6cdd0765b87aab79ed3ac006225
+        id: scan
+        with:
+          path: "."
+          fail-build: true
+          severity-cutoff: negligible
+      - name: Show Anchore scan SARIF report
+        if: always()
+        run: cat ${{ steps.scan.outputs.sarif }}
+      - name: Upload Anchore scan SARIF report
+        if: always()
+        uses: github/codeql-action/upload-sarif@0c670bbf0414f39666df6ce8e718ec5662c21e03
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+
   yaml-lint:
     name: YAML
     runs-on: ubuntu-latest

.github/workflows/report.yml

@@ -0,0 +1,29 @@
+---
+name: Reporting
+
+on:
+  push:
+    branches:
+      - devel
+      - release-*
+
+jobs:
+  vulnerability-scan:
+    name: Vulnerability Scanning
+    if: github.repository_owner == 'submariner-io'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+      - name: Run Anchore vulnerability scanner
+        uses: anchore/scan-action@516844f15d82b6cdd0765b87aab79ed3ac006225
+        id: scan
+        with:
+          path: "."
+          fail-build: false
+      - name: Show Anchore scan SARIF report
+        run: cat ${{ steps.scan.outputs.sarif }}
+      - name: Upload Anchore scan SARIF report
+        uses: github/codeql-action/upload-sarif@0c670bbf0414f39666df6ce8e718ec5662c21e03
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}

.grype.yaml

@@ -0,0 +1,12 @@
+---
+ignore:
+  # False positive, CVE is actually about the C++ project protocolbuffers/protobuf
+  # https://github.com/anchore/grype/issues/558
+  - vulnerability: CVE-2015-5237
+    package:
+      name: google.golang.org/protobuf
+  # False positive, CVE is actually about the C++ project protocolbuffers/protobuf
+  # https://github.com/anchore/grype/issues/633
+  - vulnerability: CVE-2021-22570
+    package:
+      name: google.golang.org/protobuf