test: add docker scout

Signed-off-by: Robert Waffen <[email protected]>

.github/workflows/docker_scout.yml

@@ -0,0 +1,66 @@
+---
+name: Docker Scout
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - 'main'
+  workflow_dispatch:
+
+jobs:
+  setup-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Source checkout
+        uses: actions/checkout@v4
+
+      - id: set-matrix
+        run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT
+
+  build_test_container:
+    name: 'Build test container'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+      pull-requests: write
+    needs: setup-matrix
+    strategy:
+      matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
+    steps:
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: voxpupulibot
+        password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}
+
+    - name: Analyze container image for CVEs
+      id: analyze-image-cves
+      uses: docker/scout-action@v1
+      with:
+        command: cves
+        image: 'local://ci/voxbox:${{ matrix.rubygem_puppet }}'
+        sarif-file: sarif.output.${{ matrix.rubygem_puppet }}.${{ github.sha }}.json
+        write-comment: false
+
+    - name: Compare container image to latest from Registry
+      id: compare-image
+      uses: docker/scout-action@v1
+      with:
+        command: compare
+        image: 'local://ci/voxbox:${{ matrix.rubygem_puppet }}'
+        to: 'ghcr.io/voxpupuli/voxbox:${{ matrix.puppet_release }}-main'
+        summary: true
+        keep-previous-comments: true
+
+    - name: Upload SARIF result
+      id: upload-sarif
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: sarif.output.${{ matrix.rubygem_puppet }}.${{ github.sha }}.json