Add automated security scanning of container images

[jaydrogers]

Problem

• There are many dependencies within a PHP docker image and as of now, there's no automated security notification

Proposed Solution

• Integrate an automated security container scanning service that will scan all dependencies within each container image
• The container security report should be public for the world to review

Requirements

• Must work with GitHub actions
• Must be open and report results to the world
• Must be free to use for Open Source projects
• Must notify maintainers in some manner when there is a critical vulnerability

Open for discussion

1. Do you have any recommendations on what service to use?

Please comment below 🙌

[minkbear]

https://snyk.io/product/container-vulnerability-management/
What do you think?