chore/security : debug

Author: issam71100

.github/workflows/lrm-client-ci.yaml

@@ -148,14 +148,16 @@ jobs:
           category: 'trivy-lrm-client-dependencies'
 
       - name: Run Trivy vulnerability scanner - Dockerfile
+        id: trivy-dockerfile
         uses: aquasecurity/trivy-action@0.24.0
         with:
           scan-type: 'config'
           scan-ref: 'web/lrm/client/Dockerfile'
           format: 'sarif'
           output: 'trivy-dockerfile.sarif'
-          severity: 'HIGH,CRITICAL'
-          exit-code: '0'
+          severity: 'LOW,MEDIUM,HIGH,CRITICAL'
+          exit-code: '1'
+          scanners: 'config,secret'
         continue-on-error: true
 
       - name: Fix Dockerfile SARIF file paths for GitHub Security tab
@@ -165,17 +167,78 @@ jobs:
           sarif-file: 'trivy-dockerfile.sarif'
           scan-path: 'web/lrm/client'
 
-      - name: Check if dockerfile SARIF file exists
+      - name: Debug Dockerfile scan and analyze results
         if: always()
         run: |
+          echo "🐳 === Dockerfile Scan Debug Information ==="
+          echo "Trivy Dockerfile scan outcome: ${{ steps.trivy-dockerfile.outcome }}"
+          echo ""
+          
+          # Check if Dockerfile exists
+          if [ -f "web/lrm/client/Dockerfile" ]; then
+            echo "✅ Dockerfile found at web/lrm/client/Dockerfile"
+            echo "📄 Dockerfile size: $(du -h web/lrm/client/Dockerfile)"
+            echo ""
+            echo "🔍 Dockerfile content preview:"
+            head -10 web/lrm/client/Dockerfile
+          else
+            echo "❌ Dockerfile not found at web/lrm/client/Dockerfile"
+          fi
+          
+          echo ""
+          echo "📊 === SARIF File Analysis ==="
           if [ -f "trivy-dockerfile.sarif" ]; then
-            echo "✅ Dockerfile SARIF file found"
-            echo "File size: $(du -h trivy-dockerfile.sarif)"
-            echo "First few lines:"
-            head -10 trivy-dockerfile.sarif
+            echo "✅ Dockerfile SARIF file generated"
+            echo "📄 File size: $(du -h trivy-dockerfile.sarif)"
+            
+            # Check if jq is available for better analysis
+            if command -v jq > /dev/null 2>&1; then
+              echo ""
+              echo "🔍 SARIF Content Analysis:"
+              
+              # Count total results
+              TOTAL_RESULTS=$(jq '[.runs[]?.results[]?] | length' trivy-dockerfile.sarif 2>/dev/null || echo "0")
+              echo "   • Total issues found: $TOTAL_RESULTS"
+              
+              # Count by severity
+              HIGH_CRITICAL=$(jq '[.runs[]?.results[]? | select(.level == "error")] | length' trivy-dockerfile.sarif 2>/dev/null || echo "0")
+              MEDIUM_LOW=$(jq '[.runs[]?.results[]? | select(.level == "warning" or .level == "info")] | length' trivy-dockerfile.sarif 2>/dev/null || echo "0")
+              echo "   • High/Critical issues: $HIGH_CRITICAL"  
+              echo "   • Medium/Low issues: $MEDIUM_LOW"
+              
+              if [ "$TOTAL_RESULTS" -gt 0 ]; then
+                echo ""
+                echo "🚨 Issues detected:"
+                jq -r '.runs[]?.results[]? | "   • " + (.ruleId // "Unknown") + ": " + .message.text' trivy-dockerfile.sarif 2>/dev/null | head -10
+              else
+                echo ""
+                echo "ℹ️  No configuration issues detected in SARIF"
+              fi
+            else
+              echo "ℹ️  jq not available for detailed analysis"
+              echo ""
+              echo "📄 Raw SARIF preview (first 20 lines):"
+              head -20 trivy-dockerfile.sarif
+            fi
           else
             echo "❌ Dockerfile SARIF file not found"
           fi
+          
+          echo ""
+          echo "🛠️  === Manual Trivy Test ==="
+          echo "Running manual Trivy scan for comparison..."
+          
+          # Install trivy if not available
+          if ! command -v trivy > /dev/null 2>&1; then
+            sudo apt-get update && sudo apt-get install -y wget apt-transport-https gnupg lsb-release
+            wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
+            echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
+            sudo apt-get update && sudo apt-get install -y trivy
+          fi
+          
+          # Run manual config scan
+          echo "Running: trivy config --format table --severity LOW,MEDIUM,HIGH,CRITICAL web/lrm/client/Dockerfile"
+          trivy config --format table --severity LOW,MEDIUM,HIGH,CRITICAL web/lrm/client/Dockerfile || echo "Manual scan failed"
 
       - name: Upload Trivy scan results to GitHub Security tab - Dockerfile
         if: always() && hashFiles('trivy-dockerfile.sarif') != ''