Update the python tooling in the ingest container (#403)

We were updating the python tooling (`setuptools` & friends) in the
builder layer but forgot to update them in the prod layer. This resulted
in a `setuptools` vulnerability blocking CI.

This PR:
- updates `setuptools` & friends in the correct locations in the docker
image
- removes the docker build caching in CI as it wasn't doing anything. (I
made #404 to address this)
- Updates the security scanning step in CI to add more actionable
output.

.github/workflows/ci.yml

@@ -111,11 +111,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           push: true
-          # Use a cache to speed up builds
-          # Note: this may cause security issues if the apt updates are cached
-          # It may make more sense to build eccodes as its own image instead.
-          cache-from: type=registry,ref=ghcr.io/noaa-gsl/vxingest/cache/ingest:buildcache
-          cache-to: type=registry,ref=ghcr.io/noaa-gsl/vxingest/cache/ingest:buildcache,mode=max
   build-import:
     name: Build Import image
     runs-on: ubuntu-latest
@@ -165,6 +160,18 @@ jobs:
       - name: Extract SHORT_SHA
         run: echo "SHORT_SHA=${GITHUB_SHA::7}" >> "$GITHUB_ENV"
       - name: Scan image with Trivy
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: "ghcr.io/noaa-gsl/vxingest/ingest:sha-${{ env.SHORT_SHA }}"
+          format: "table" # Generate actionable output
+          ignore-unfixed: true
+          severity: "CRITICAL,HIGH"
+          exit-code: "1"
+        env:
+          TRIVY_USERNAME: ${{ github.actor }}
+          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate Trivy output formatted for the GitHub Security tab
+        if: always()
         uses: aquasecurity/[email protected]
         with:
           image-ref: "ghcr.io/noaa-gsl/vxingest/ingest:sha-${{ env.SHORT_SHA }}"
@@ -173,7 +180,6 @@ jobs:
           ignore-unfixed: true
           severity: "CRITICAL,HIGH"
           limit-severities-for-sarif: true
-          exit-code: "1"
         env:
           TRIVY_USERNAME: ${{ github.actor }}
           TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
@@ -190,6 +196,18 @@ jobs:
       - name: Extract SHORT_SHA
         run: echo "SHORT_SHA=${GITHUB_SHA::7}" >> "$GITHUB_ENV"
       - name: Scan image with Trivy
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: "ghcr.io/noaa-gsl/vxingest/import:sha-${{ env.SHORT_SHA }}"
+          format: "table" # Generate actionable output
+          ignore-unfixed: true
+          severity: "CRITICAL,HIGH"
+          # exit-code: "1" # FIXME: allow failures for now. Couchbase needs to update cbtools
+        env:
+          TRIVY_USERNAME: ${{ github.actor }}
+          TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate Trivy output formatted for the GitHub Security tab
+        if: always()
         uses: aquasecurity/[email protected]
         with:
           image-ref: "ghcr.io/noaa-gsl/vxingest/import:sha-${{ env.SHORT_SHA }}"
@@ -198,7 +216,6 @@ jobs:
           ignore-unfixed: true
           severity: "CRITICAL,HIGH"
           limit-severities-for-sarif: true
-          # exit-code: "1" # FIXME: allow failures for now. Couchbase needs to update cbtools
         env:
           TRIVY_USERNAME: ${{ github.actor }}
           TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

docker/ingest/Dockerfile

@@ -40,6 +40,7 @@ RUN apt-get update && \
     apt-get install -y build-essential && \
     apt-get clean && rm -rf /var/lib/apt/lists/* 
 
+# Make sure the python tooling is up-to-date for when it's copied into the prod layer
 RUN pip install --no-cache-dir --upgrade pip setuptools wheel
 RUN pip install --no-cache-dir poetry
 
@@ -81,6 +82,9 @@ ENV VERSION=${BUILDVER}
 
 LABEL version=${BUILDVER} code.branch=${COMMITBRANCH} code.commit=${COMMITSHA}
 
+# Update the image's built in Python tooling before we activate the virtual environment
+RUN pip install --no-cache-dir --upgrade pip setuptools
+
 # Activate the virtual environment
 ENV VIRTUAL_ENV=/app/.venv \
     PATH="/app/.venv/bin:$PATH"