Add trivy and sonar repo scan to GitHub actions [3]

[MartinWahnschaffe]

Problem Description

We are currently using CodeQL to scan for security problems integrated into Github and sonarqube to do a more detailed scan which also includes CVE vulnerabilities. Unfortunately sonarqube is not integrated into the pull request mechanics so it's easy to miss new vulnerabilities.

Proposed Change

• Use trivy to check for vulnerabilities (most importantly CVE https://avd.aquasec.com/). This should be integrated into the checks executed for pull requests.
• Include current rules from SonarQube and let these rules evaluate new code in a pull request (for now don't block the pull request).

Acceptance Criteria

• Warnings for existing problems are shown as security alerts on Github
• Vulnerabilities in pull requests are shown as part of the checks.

Alternatives

Use sonarcloud: https://sonarcloud.io/github

[MartinWahnschaffe]

To be done:

• both should not block PRs
• Add rules from existing sonarcube

[JonasCir]

@MartinWahnschaffe Unfortunately, we cannot avoid the CI failing. Once a critical errror is detected in the PR, the corresponding CI pass will fail. You only control the severity level (low, medium, high, critical), but you cannot disable it.

Looking into the existing rules now...