feat: run trivy security scanner during release (#106)

script/release-workflow/run.sh

@@ -13,6 +13,7 @@ fi
 
 ${script_dir}/validate.sh
 ${script_dir}/docker-build.sh
+${script_dir}/../scan.sh ${DOCKER_IMAGE_ORG_AND_NAME}:latest
 
 if [ "${GITHUB_ACTIONS:-}" = "true" ]; then
   bundle install

script/scan-inside-docker-container.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env sh
+set -eu
+
+apt-get update -y && apt-get install -y wget
+wget -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/install.sh | sh -s -- -b /usr/local/bin
+trivy filesystem --exit-code 1 --quiet /

script/scan.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -eu
+
+: "${1?Please provide the image to scan}"
+
+SCRIPT_DIR=$(cd "$(dirname $0)"/.. && pwd)
+
+docker run --rm \
+  -v ${PWD}/script/scan-inside-docker-container.sh:/pact_broker/scan-inside-docker-container.sh \
+  -u root \
+  --entrypoint /bin/sh \
+  "$1" \
+  /pact_broker/scan-inside-docker-container.sh