UID2-7877: Scan all sample Docker images for vulnerabilities

.github/workflows/vulnerability-scan-failure-notify.yaml

@@ -1,4 +1,4 @@
-name: Vulnerability Scan Failure Slack Notify
+name: Vulnerability Scan
 on:
   workflow_dispatch:
     inputs:
@@ -15,9 +15,84 @@ on:
     - cron: '0 0 * * *'   # 5:00 PM GMT -7
 
 jobs:
-  vulnerability-scan-failure-notify:
-    uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-vulnerability-scan-failure-notify.yaml@v3
-    secrets:
-      SLACK_WEBHOOK : ${{ secrets.SLACK_WEBHOOK }}
-    with:
-      scan_type : fs
+  filesystem-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Scan repository
+        uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3
+        with:
+          scan_type: fs
+          scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          publish_vulnerabilities: 'false'
+
+  # A filesystem scan only checks files in the repository. Build every image with the same
+  # Dockerfile/context pair used by release-all-docker-images.yaml so base image and installed
+  # runtime package vulnerabilities are also detected.
+  image-scan:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: reverse-proxy
+            dockerfile: tools/reverse-proxy/Dockerfile
+            context: tools/reverse-proxy
+          - name: secure-signals-client-server
+            dockerfile: web-integrations/google-secure-signals/client-server/Dockerfile
+            context: web-integrations/google-secure-signals/client-server
+          - name: secure-signals-client-side
+            dockerfile: web-integrations/google-secure-signals/client-side/Dockerfile
+            context: web-integrations/google-secure-signals/client-side
+          - name: secure-signals-server-side
+            dockerfile: web-integrations/google-secure-signals/server-side/Dockerfile
+            context: web-integrations/google-secure-signals/server-side
+          - name: secure-signals-react-client-side
+            dockerfile: web-integrations/google-secure-signals/react-client-side/Dockerfile
+            context: web-integrations/google-secure-signals/react-client-side
+          - name: javascript-sdk-client-side
+            dockerfile: web-integrations/javascript-sdk/client-side/Dockerfile
+            context: web-integrations/javascript-sdk/client-side
+          - name: javascript-sdk-client-server
+            dockerfile: web-integrations/javascript-sdk/client-server/Dockerfile
+            context: web-integrations/javascript-sdk/client-server
+          - name: javascript-sdk-react-client-side
+            dockerfile: web-integrations/javascript-sdk/react-client-side/Dockerfile
+            context: web-integrations/javascript-sdk/react-client-side
+          - name: server-side
+            dockerfile: web-integrations/server-side/Dockerfile
+            context: web-integrations/server-side
+          - name: prebid-client-side
+            dockerfile: web-integrations/prebid-integrations/client-side/Dockerfile
+            context: web-integrations/prebid-integrations
+          - name: prebid-client-server
+            dockerfile: web-integrations/prebid-integrations/client-server/Dockerfile
+            context: web-integrations/prebid-integrations
+          - name: prebid-client-side-deferred
+            dockerfile: web-integrations/prebid-integrations/client-side-deferred/Dockerfile
+            context: web-integrations/prebid-integrations
+          - name: prebid-secure-signals-client-side
+            dockerfile: web-integrations/prebid-secure-signals/client-side/Dockerfile
+            context: web-integrations/prebid-secure-signals
+          - name: hashing-tool
+            dockerfile: tools/hashing-tool/Dockerfile
+            context: tools/hashing-tool
+    name: Image scan - ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Build image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.dockerfile }}
+          load: true
+          tags: image-scan:${{ matrix.name }}-${{ github.sha }}
+      - name: Scan image
+        uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3
+        with:
+          scan_type: image
+          image_ref: image-scan:${{ matrix.name }}-${{ github.sha }}
+          scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }}
+          publish_vulnerabilities: 'false'