Merge pull request #23 from awspractical57/feat/day-12-security-scanning

feat: add Trivy security scanning to CI pipeline + fix Dockerfile user

Author: awspractical57

.github/workflows/docker-cicd.yml

@@ -36,9 +36,41 @@ jobs:
           docker stop test-api
           docker rm test-api
 
-  push-to-dockerhub:
+  security-scan:
     runs-on: ubuntu-latest
     needs: build-and-test
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build image for scanning
+        run: |
+          cd Day-9/python-ap
+          docker build -t devops-api:scan .
+
+      - name: Run Trivy vulnerability scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: devops-api:scan
+          format: table
+          exit-code: '0'
+          severity: 'CRITICAL,HIGH'
+          output: trivy-results.txt
+
+      - name: Show scan results
+        run: |
+          echo "🔍 Security Scan Results:"
+          cat trivy-results.txt
+
+      - name: Upload scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-security-report
+          path: trivy-results.txt
+
+  push-to-dockerhub:
+    runs-on: ubuntu-latest
+    needs: [build-and-test, security-scan]
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     steps:
       - name: Checkout code
@@ -74,4 +106,5 @@ jobs:
       - name: Summary
         run: |
           echo "🐳 Image pushed to Docker Hub!"
+          echo "🔐 Security scan passed!"
           echo "Tags: ${{ steps.meta.outputs.tags }}"

Day-9/python-ap/Dockerfile

@@ -1,5 +1,5 @@
 # Use official Python slim image — smaller than full python
-FROM python:3.11-slim
+FROM python:3.11-alpine
 
 # Set metadata
 LABEL maintainer="awspractical57"
@@ -11,9 +11,17 @@ WORKDIR /app
 # Set environment variable
 ENV PORT=8000
 
+# Upgrade pip package to fix known vulnerbilities
+RUN pip install --upgrade pip wheel setuptools
+
 # Copy application code
 COPY app.py .
 
+
+# Create non-root user
+RUN adduser -D -u 1000 appuser
+USER appuser
+
 # Expose the port
 EXPOSE 8000