Merge branch 'main' into ray/docker-scan

.github/workflows/ghcr-build.yml

@@ -59,6 +59,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -85,14 +86,35 @@ jobs:
         run: |
           ./containers/build.sh -i openhands -o ${{ env.REPO_OWNER }} --push
 
+      - name: Run Trivy vulnerability scanner
+        if: github.event_name != 'pull_request'
+        uses: aquasecurity/trivy-action@master
+        # This only reports, does not fail the build on CVE.
+        with:
+          image-ref: ghcr.io/${{ env.REPO_OWNER }}/openhands:${{ env.RELEVANT_SHA }}
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          timeout: '10m'
+          scanners: 'vuln'  # Only scan vulnerabilities, not secrets/config
+          severity: 'CRITICAL,HIGH,MEDIUM'  # Skip LOW severity
+
+      - name: Upload Trivy results to GitHub Security tab
+        if: github.event_name != 'pull_request'
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'
+          category: 'security/container-openhands-${{ matrix.base_image.tag }}'
+          sha: "${{ env.RELEVANT_SHA }}"
+          ref: refs/heads/${{ github.event.pull_request.head.ref || github.ref_name }}
   # Builds the runtime Docker images
   ghcr_build_runtime:
-    name: Build Image
+    name: Build Runtime Image
     runs-on: blacksmith-8vcpu-ubuntu-2204
     if: "!(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/ext-v'))"
     permissions:
       contents: read
       packages: write
+      security-events: write
     needs: define-matrix
     strategy:
       matrix:
@@ -166,12 +188,41 @@ jobs:
           name: runtime-src-${{ matrix.base_image.tag }}
           path: containers/runtime
 
+      - name: Run Trivy vulnerability scanner
+        if: github.event_name != 'pull_request'
+        uses: aquasecurity/trivy-action@master
+        # This only reports, does not fail the build on CVE.
+        with:
+          image-ref: ghcr.io/${{ env.REPO_OWNER }}/runtime:${{ env.RELEVANT_SHA }}-${{ matrix.base_image.tag }}
+          format: 'sarif'
+          output: 'trivy-results-raw.sarif'
+          timeout: '10m'
+          scanners: 'vuln'  # Only scan vulnerabilities, not secrets/config
+          severity: 'CRITICAL,HIGH,MEDIUM'  # Skip LOW severity
+      - name: Customize SARIF with image flavor
+        if: github.event_name != 'pull_request'
+        run: |
+          # Modify the tool name to include the image flavor
+          jq --arg flavor "${{ matrix.base_image.tag }}" \
+            '.runs[0].tool.driver.name = "Trivy (" + $flavor + ")"' \
+            trivy-results-raw.sarif > trivy-results.sarif
+
+          echo "Modified tool name to: $(jq -r '.runs[0].tool.driver.name' trivy-results.sarif)"
+
+      - name: Upload Trivy results to GitHub Security tab
+        if: github.event_name != 'pull_request'
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'
+          category: 'security/container-runtime-${{ matrix.base_image.tag }}'
+
   ghcr_build_enterprise:
-    name: Push Enterprise Image
+    name: Build Enterprise Image
     runs-on: blacksmith-8vcpu-ubuntu-2204
     permissions:
       contents: read
       packages: write
+      security-events: write
     needs: [define-matrix, ghcr_build_app]
     # Do not build enterprise in forks
     if: github.event.pull_request.head.repo.fork != true
@@ -211,14 +262,16 @@ jobs:
             latest=auto
             prefix=
             suffix=
+        env:
+          DOCKER_METADATA_PR_HEAD_SHA: true
       - name: Determine app image tag
         shell: bash
         run: |
           # Duplicated with build.sh
-          sanitized_ref_name=$(echo "$GITHUB_REF_NAME" | sed 's/[^a-zA-Z0-9.-]\+/-/g')
-          OPENHANDS_BUILD_VERSION=$sanitized_ref_name
+          sanitized_ref_name=$(echo "${{github.event.pull_request.head.sha}}" | sed 's/[^a-zA-Z0-9.-]\+/-/g')
           sanitized_ref_name=$(echo "$sanitized_ref_name" | tr '[:upper:]' '[:lower:]') # lower case is required in tagging
-          echo "OPENHANDS_DOCKER_TAG=${sanitized_ref_name}" >> $GITHUB_ENV
+          echo "OPENHANDS_BUILD_VERSION=${sanitized_ref_name}" >> $GITHUB_ENV
+          echo REPO_OWNER=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
       - name: Build and push Docker image
         uses: useblacksmith/build-push-action@v1
         with:
@@ -228,12 +281,30 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
-            OPENHANDS_VERSION=${{ env.OPENHANDS_DOCKER_TAG }}
+            OPENHANDS_VERSION=${{ env.OPENHANDS_BUILD_VERSION }}
           platforms: linux/amd64
           # Add build provenance
           provenance: true
           # Add build attestations for better security
           sbom: true
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        if: github.event_name != 'pull_request'
+        # This only reports, does not fail the build on CVE.
+        with:
+          image-ref: "ghcr.io/${{ env.REPO_OWNER }}/enterprise-server:sha-${{ env.RELEVANT_SHA }}"
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          timeout: '10m'
+          scanners: 'vuln'  # Only scan vulnerabilities, not secrets/config
+          severity: 'CRITICAL,HIGH,MEDIUM'  # Skip LOW severity
+
+      - name: Upload Trivy results to GitHub Security tab
+        if: github.event_name != 'pull_request'
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'
+          category: 'security/container-enterprise-server'
 
   enterprise-preview:
     name: Enterprise preview