ci: re-enable trivy vulnerability scanning with SHA-pinned action

.github/workflows/build.yaml

@@ -59,22 +59,22 @@ jobs:
           path: ${{ env.tar_file }}
           retention-days: 1
 
-#   scan-docker-image-with-trivy:
-#     needs: build-docker-image
-#     runs-on: ubuntu-latest
-#     steps:
-#       - name: Download Docker image artifact
-#         uses: actions/download-artifact@v4
-#         with:
-#           name: ${{ needs.build-docker-image.outputs.tar_file }}
-# 
-#       - name: Load Docker image
-#         run: |
-#           docker load -i ${{ needs.build-docker-image.outputs.tar_file }}
-#       - name: Run Trivy vulnerability scan
-#         uses: aquasecurity/trivy-action@v0.35.0
-#         with:
-#           image-ref: '${{ needs.build-docker-image.outputs.image_name }}'
-#           format: 'table'
-#           exit-code: 1
-#           severity: 'CRITICAL,HIGH'
+  scan-docker-image-with-trivy:
+    needs: build-docker-image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Docker image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.build-docker-image.outputs.tar_file }}
+
+      - name: Load Docker image
+        run: |
+          docker load -i ${{ needs.build-docker-image.outputs.tar_file }}
+      - name: Run Trivy vulnerability scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: '${{ needs.build-docker-image.outputs.image_name }}'
+          format: 'table'
+          exit-code: 1
+          severity: 'CRITICAL,HIGH'

Dockerfile

@@ -20,14 +20,15 @@ RUN npm update -g npm
 COPY ./ /app/
 WORKDIR /app/
 
-RUN npm install
+RUN npm ci
 
-# we use unsafe install because we have ignored all the test files to keep the image size small
-# the test files are not needed in the production image
-# therefore, please ensure that the tests are green before building the image
-RUN npm run install-bin-unsafe
+# Compile with dev dependencies present, then prune them so the runtime image
+# only carries production dependencies before the global CLI install.
+RUN npm run compile \
+    && npm prune --omit=dev \
+    && npm install -g .
 
 RUN mkdir /etc/connector/
 WORKDIR /etc/connector/
 
-ENTRYPOINT [ "ndc-oas-lambda" ]
+ENTRYPOINT [ "ndc-oas-lambda" ]

package.json

@@ -42,5 +42,14 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.4.2",
     "webpack": "^5.89.0"
+  },
+  "overrides": {
+    "@ts-morph/common": {
+      "minimatch": "9.0.7"
+    },
+    "micromatch": {
+      "picomatch": "2.3.2"
+    },
+    "lodash": "4.18.1"
   }
 }