Setup sysdig scanning in CI

[ian-noaa]

Setup the Sysdig CI scanner alongside Trivy in the MATS CI pipelines so that we can evaluate it. I set the Sysdig scanner up in "informational" mode - it won't fail CI if the scan fails. If we adopt the scanner going forward, we'll want to change that.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[ian-noaa]

FYI @shannon-m-johnston & @RVNOAA. Seems like it worked! I'll check our sysdig portal in the morning.

You can view the diff ("Files Changed" tab) to see what I changed for my pipeline here.

[ian-noaa]

We can see the scan results from Github by jumping into the pipeline. (E.g. https://github.com/NOAA-GSL/MATS/actions/runs/28565792152) I'm probably going to need to tweak the configuration to get CI to work the way we'd like.

Results show up in the portal like so: https://us2.app.sysdig.com/secure/#/vulnerabilities/results/18be5f9af2904fd86bcc1de948a525a0/overview

[ian-noaa]

@mollybsmith-noaa - GSL has a new security scanner that we're evaluating. I've set it up in the MATS pipelines alongside Trivy so that we can check it out. I set it up in "informational" mode - it won't fail CI if the scan fails. If we adopt the scanner going forward, we'll want to change that.

I'm hoping its output will provide better feedback on what it's detected than Trivy. It looks like it drops its feedback in the CI job "Summary" tab. (https://github.com/NOAA-GSL/MATS/actions/runs/28606734894?pr=1416) The per-layer breakdown of the image is particularly helpful - Trivy just tells you that it found issues in the image as a whole, and I've then had to go try to figure out which part of the image they're coming from. I also appreciate that it lists the vulnerabilities in the CI output - Trivy makes you hunt for them elsewhere in Github.

[mollybsmith-noaa]

Sorry to be slow, this looks good to me!

[ian-noaa]

No worries! You definitely weren't slow. It'll be interesting to see how this shapes up as it migrates towards the main branch!