Feature/container scan

.github/workflows/build-test.yml

@@ -0,0 +1,46 @@
+name: Build and Test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  vote-service:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./vote
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - run: pip install -r requirements.txt
+      - run: echo "No test suite in this sample app — build/install verified"
+
+  result-service:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./result
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm install
+      - run: echo "No test suite in this sample app — build/install verified"
+
+  worker-service:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./worker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '7.0.x'
+      - run: dotnet restore
+      - run: dotnet build --configuration Release
+      - run: echo "No test suite in this sample app — build verified"

.github/workflows/container-scan.yml

@@ -0,0 +1,25 @@
+name: Container Build and Scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build-and-scan:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        service: [vote, result, worker]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image
+        run: docker build -t ${{ matrix.service }}:scan-test ./${{ matrix.service }}
+
+      - name: Scan image with Trivy
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ matrix.service }}:scan-test'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '1'

.github/workflows/sast-scan.yml

@@ -0,0 +1,21 @@
+name: SAST Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  sonarcloud:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: SonarCloud Scan
+        uses: SonarSource/sonarqube-scan-action@a31c9398be7ace6bbfaf30c0bd5d415f843d45e9 # v7.0.0
+        env:
+          SONAR_HOST_URL: https://sonarcloud.io
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/sca-scan.yml

@@ -0,0 +1,19 @@
+name: SCA Scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  trivy-fs-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '1'

.github/workflows/secrets-scan.yml

@@ -0,0 +1,19 @@
+name: Secrets Scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

result/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:18-slim
+FROM node:22-bookworm-slim
 
 # add curl for healthcheck
 RUN apt-get update && \