ci: [KAN-137] add trivy scan

.github/workflows/trivy.yml

@@ -0,0 +1,34 @@
+name: Build & Trivy Scan
+on:
+    push:
+        branches:
+            - main
+    pull_request:
+        branches:
+            - main
+
+jobs:
+  build-and-scan:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image
+        run: |
+          docker build -t "${DOCKER_HUB_USERNAME}/ceramicraft-user-mservice:${{ github.sha }}" server/
+
+      # scan and block if high severity vulnerabilities found
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "${{ env.DOCKER_HUB_USERNAME }}/ceramicraft-user-mservice:${{ github.sha }}"
+          format: 'table'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '1'          # non zero exit code if vulnerabilities found
+          ignore-unfixed: true    # ignore unfixed vulnerabilities

server/Dockerfile

@@ -1,5 +1,5 @@
 # Use the official Go image with version 1.24
-FROM golang:1.24.0-alpine AS builder 
+FROM golang:1.24.6-alpine AS builder 
 
 # Set the working directory inside the container
 WORKDIR /app

server/go.mod

@@ -72,7 +72,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
-	github.com/quic-go/quic-go v0.54.0 // indirect
+	github.com/quic-go/quic-go v0.54.1 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/segmentio/kafka-go v0.4.49
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect

server/go.sum

@@ -125,6 +125,8 @@ github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
 github.com/quic-go/quic-go v0.54.0 h1:6s1YB9QotYI6Ospeiguknbp2Znb/jZYjZLRXn9kMQBg=
 github.com/quic-go/quic-go v0.54.0/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
+github.com/quic-go/quic-go v0.54.1 h1:4ZAWm0AhCb6+hE+l5Q1NAL0iRn/ZrMwqHRGQiFwj2eg=
+github.com/quic-go/quic-go v0.54.1/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
 github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=

server/log/logger.go

@@ -19,8 +19,13 @@ func InitLogger() {
 	writeSyncer := getLogWriter()
 	encoder := getEncoder()
 	fileCore := zapcore.NewCore(encoder, writeSyncer, getLogLevel())
-	consoleCore := zapcore.NewCore(encoder, zapcore.AddSync(os.Stdout), getLogLevel())
-	core := zapcore.NewTee(fileCore, consoleCore)
+	var core zapcore.Core
+	if config.Config.LogConfig.FilePath != "" {
+		consoleCore := zapcore.NewCore(encoder, zapcore.AddSync(os.Stdout), getLogLevel())
+		core = zapcore.NewTee(fileCore, consoleCore)
+	} else {
+		core = fileCore
+	}
 	Logger = zap.New(core, zap.AddCaller()).Sugar()
 }