feat: supply chain security - trivy, sbom, cosign (epic #99)

.github/workflows/build-test.yml

@@ -18,6 +18,17 @@ on:
       - ".dockerignore"
       - "hadolint.yaml"
       - ".github/workflows/build-test.yml"
+  pull_request:
+    branches:
+      - master
+    paths:
+      - "Dockerfile"
+      - "supported_versions.json"
+      - "tests/**"
+      - ".github/workflows/build-test.yml"
+
+permissions:
+  contents: read
 
 env:
   IMAGE_NAME: "terraform-aws-cli"
@@ -75,6 +86,16 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@0.36.0
+        with:
+          image-ref: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: os,library
+          severity: CRITICAL
+
       - name: Generate test config
         run: |
           export TF_VERSION=${{ matrix.tf_versions }}

.github/workflows/dockerhub-description-update.yml

@@ -9,6 +9,9 @@ on:
     paths:
       - README.md
       - .github/workflows/dockerhub-description.yml
+permissions:
+  contents: read
+
 jobs:
   dockerHubDescription:
     runs-on: ubuntu-22.04

.github/workflows/lint-dockerfile.yml

@@ -14,6 +14,9 @@ on:
       - "Dockerfile"
       - ".github/workflows/lint-dockerfile.yml"
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-22.04

.github/workflows/push-latest.yml

@@ -16,6 +16,10 @@ on:
       - "supported_platforms.json"
       - "tests/**"
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build_push_latest:
     runs-on: ubuntu-22.04

.github/workflows/release.yml

@@ -5,6 +5,11 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write  # required for cosign keyless OIDC signing
+
 jobs:
   load_supported_versions:
     runs-on: ubuntu-22.04
@@ -61,3 +66,26 @@ jobs:
           push: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0.24.0
+        with:
+          image: zenika/terraform-aws-cli:release-${{ env.RELEASE_TAG }}_terraform-${{ matrix.tf_versions }}_awscli-${{ matrix.awscli_versions }}
+          format: spdx-json
+          output-file: sbom-tf${{ matrix.tf_versions }}-aws${{ matrix.awscli_versions }}.spdx.json
+
+      - name: Upload SBOM to release
+        uses: anchore/sbom-action/publish-sbom@v0.24.0
+        with:
+          sbom-artifact-match: ".*\\.spdx\\.json$"
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v4.1.1
+
+      - name: Sign published image
+        env:
+          COSIGN_EXPERIMENTAL: "true"
+        run: |
+          IMAGE_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' \
+            zenika/terraform-aws-cli:release-${{ env.RELEASE_TAG }}_terraform-${{ matrix.tf_versions }}_awscli-${{ matrix.awscli_versions }})
+          cosign sign --yes "${IMAGE_DIGEST}"

SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release is actively supported with security updates.
+
+| Version | Supported |
+| ------- | --------- |
+| latest  | ✅        |
+| older   | ❌        |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues.
+
+Instead, report them by opening a [GitHub Security Advisory](https://github.com/bgauduch/terraform-aws-cli/security/advisories/new).
+
+You can expect:
+- **Acknowledgement** within 48 hours
+- **Status update** within 7 days
+- **Fix or mitigation** within 90 days depending on severity
+
+## Security Measures
+
+This project implements the following supply chain security measures:
+
+- **Binary verification**: Terraform and AWS CLI binaries are verified using GPG signatures and SHA256 checksums before inclusion in the image
+- **Non-root container**: The image runs as a non-root user (`nonroot`, UID 1001)
+- **Minimal base image**: Uses Debian slim to reduce attack surface
+- **Vulnerability scanning**: Images are scanned with [Trivy](https://github.com/aquasecurity/trivy) on every build
+- **SBOM**: A Software Bill of Materials (SPDX format) is attached to every release
+- **Image signing**: Released images are signed using [cosign](https://github.com/sigstore/cosign) with keyless signing (Sigstore)
+
+### Verifying image signatures
+
+```bash
+cosign verify ghcr.io/bgauduch/terraform-aws-cli:<tag> \
+  --certificate-identity-regexp="https://github.com/bgauduch/terraform-aws-cli/.github/workflows/release.yml@refs/tags/.*" \
+  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
+```