PLTF-24 Image scan on latest tags

[raymyers]

This runs a trivy scan on the current docker images, publishing results to the GitHub security tab.

This partially meets the requirement of vulnerability scanning for SOC 2. Example findings:

https://github.com/All-Hands-AI/OpenHands-Cloud/security/code-scanning?query=pr%3A230+is%3Aopen

The images scanned:

• runtime (soon to become agent-server)
• runtime-api
• enterprise-server

Helm Chart Checklist

• I have updated the version field in Chart.yaml for each modified chart
• I have tested the chart upgrade path from the previous version
• I have verified backwards compatibility with existing values.yaml configurations
• I have updated the chart's README.md if there are any breaking changes or new required values

Additional Notes

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[neubig]

Hi @raymyers , this is still open but the underlying issue was closed. Are you still intending to merge this or shall we close it?

[raymyers]

OK this now takes images tags from the chart I think it's ready to merge.

[raymyers]

Recording this flavor hack for posterity, as I took the comment out of the code. This was for the case of ubuntu vs debian based images. There may be a better way.

# - name: Customize SARIF with image flavor
      #   shell: bash
      #   run: |
      #     IMAGE_WITH_TAG="all-hands-ai/enterprise-server:pr-11114"
      #     IMAGE_WITHOUT_TAG="${IMAGE_WITH_TAG%%:*}"
      #     # Modify the tool name to include the image flavor
      #     jq --arg flavor "${{ env.IMAGE_WITHOUT_TAG }}" \
      #       '.runs[0].tool.driver.name = "Trivy (" + $flavor + ")"' \
      #       trivy-results-raw.sarif > trivy-results.sarif
      #     echo "Modified tool name to: $(jq -r '.runs[0].tool.driver.name' trivy-results.sarif)"