Added Trivy scanning

.github/workflows/ci-pr.yml

@@ -11,7 +11,7 @@ env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   MAVEN_THREADS: 'false'
 jobs:
-  check:
+  build:
     if: github.repository == 'spring-cloud/stream-applications'
     runs-on: ubuntu-latest
     steps:
@@ -121,3 +121,32 @@ jobs:
           path: '**/target/surefire-reports'
           retention-days: 7
           if-no-files-found: ignore
+      - name: 'Built'
+        shell: bash
+        run: echo "::info ::Built"
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run Trivy vulnerability scanner in repo mode
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'
+      - name: 'Scanned'
+        shell: bash
+        run: echo "::info ::Scanned"
+  done:
+    runs-on: ubuntu-latest
+    needs: [ scan, build ]
+    steps:
+      - name: 'Done'
+        shell: bash
+        run: echo "::info ::Done"

.github/workflows/common.yml

@@ -661,11 +661,30 @@ jobs:
             git commit -a -m "Next development version ${{ needs.parameters.outputs.next_dev_version }}"
             git push origin main
           popd > /dev/null
-
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Run Trivy vulnerability scanner in repo mode
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          ignore-unfixed: true
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'
+      - name: 'Scanned'
+        shell: bash
+        run: echo "::info ::Scanned"
   rerun-jobs:
     if: ${{ failure() && github.run_attempt == '1' }}
     runs-on: ubuntu-latest
     needs:
+      - scan
       - sources
       - processors
       - sinks