Add APK security reports

.gitea/workflows/build.yml

@@ -36,10 +36,16 @@ jobs:
       CARGO_HOME: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb/cargo"
       RUSTUP_HOME: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb/rustup"
       CARGO_TARGET_DIR: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb/target"
+      TRIVY_VERSION: "0.74.0"
+      TRIVY_SHA256: "2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a"
     steps:
       - name: Prepare Environment
         run: |
           apk add --no-cache --update abuild-rootbld alpine-sdk atools-apkbuild-lint bash ca-certificates curl doas git jq nodejs rsync shellcheck sudo tar
+          trivy_archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl -fsSL -o "/tmp/${trivy_archive}" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${trivy_archive}"
+          echo "${TRIVY_SHA256}  /tmp/${trivy_archive}" | sha256sum -c -
+          tar -xzf "/tmp/${trivy_archive}" -C /usr/local/bin trivy
           mkdir -p "$ALPINE_APK_REPO_CACHE" "$CARGO_HOME" "$RUSTUP_HOME" "$CARGO_TARGET_DIR"
           chown -R 1000:1000 /cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}
 
@@ -101,6 +107,23 @@ jobs:
         if: github.event_name != 'schedule'
         run: scripts/apk/ci-smoke.sh
 
+      - name: Generate security reports
+        if: github.event_name != 'schedule' && env.ALPINE_SKIP_BUILD != '1'
+        run: |
+          scripts/apk/security-report.sh
+          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+            find packages/security-reports -name summary.md -type f -print | sort | while IFS= read -r summary; do
+              cat "$summary"
+            done >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Upload security reports
+        if: github.event_name != 'schedule' && env.ALPINE_SKIP_BUILD != '1' && steps.artifact-upload.outputs.available == 'true'
+        uses: actions/upload-artifact@v3
+        with:
+          name: apk-security-reports-${{ matrix.alpine_registry_branch }}
+          path: packages/security-reports/
+
       - name: Runtime test
         if: github.event_name != 'schedule' && env.ALPINE_SKIP_BUILD != '1'
         run: scripts/apk/runtime-test.sh