Adding Docker Scout Security Action

[tefirman]

Description

• Testing out the addition of an security-related GitHub Action.
• Every month, this action will run Docker Scout on the "latest" version of each Docker image.
• If fixable vulnerabilities are detected, it will post an issue to the repo describing the vulnerability.
• If there's already an existing vulnerability issue from last month, it will skip it (don't want infinite issues).
• Can also be triggered manually if needed.
• Currently running hourly for testing purposes.
• Eventually want to create a similar GitHub Action for PR's into main as a required check.
  • See bot comments on this PR below for an example output.
• Also fixing a security vulnerability in bwa while I'm at it.

Related Issue

• Addresses Add automated security check #46

Testing

• See the massive amounts of security-action GitHub Actions in the past few days.

[github-actions]

🔍 Vulnerabilities of bwa-scout:latest

📦 Image Reference bwa-scout:latest

digest	sha256:b1beec5352f4f62ba1fdc33de2efc6b3dac879d2d6ee1807ae0fb0c8040edf5b
vulnerabilities
size	206 MB
packages	227

📦 Base Image ubuntu:24.04

also known as	latest noble noble-20241011
digest	sha256:5d070ad5f7fe63623cbb99b4fc0fd997f5591303d4b03ccce50f403957d0ddc4
vulnerabilities

[github-actions]

Recommended fixes for image bwa-scout:latest

Base image is ubuntu:24.04

Name	24.04
Digest	sha256:5d070ad5f7fe63623cbb99b4fc0fd997f5591303d4b03ccce50f403957d0ddc4
Vulnerabilities
Pushed	1 week ago
Size	30 MB
Packages	130
OS	24.04

The base image is also available under the supported tag(s): latest, noble, noble-20241011

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

Tag	Details	Pushed	Vulnerabilities
24.10 Minor OS version update Also known as: rolling oracular oracular-20241009	Benefits: Minor OS version update Image has similar size Image introduces no new vulnerability but removes 5 Image contains similar number of packages Image details: Size: 31 MB OS: 24.10	1 week ago

[tefirman]

GitHub Action isolated to this repo, also heavily tested on my end. Merging without approval.