chore/security : add ci for chatbot

Author: issam71100

.github/workflows/chatbot-build.yml

@@ -0,0 +1,105 @@
+name: Build Chatbot image
+
+on:
+  push:
+    tags:
+      - 'chatbot-*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
+jobs:
+  get-tag:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.extract-chatbot-version.outputs.version }}
+    steps:
+      - name: Extract version from tag
+        id: extract-chatbot-version
+        run: |
+          TAG_NAME="${{ github.ref_name }}"
+          VERSION=${TAG_NAME#chatbot-}
+          PATTERN="^([0-9]+\.[0-9]+(\.[0-9]+)?)(-[A-Za-z0-9\.]+)*$"
+          if [[ ! "$VERSION" =~ $PATTERN ]]; then
+            echo "Invalid version number: $VERSION"
+            exit 1
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+  build-image:
+    needs: get-tag
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      
+      - name: Login to Docker Hardened Images
+        uses: docker/login-action@v3
+        with:
+          registry: dhi.io
+          username: ${{ secrets.DHI_USERNAME }}
+          password: ${{ secrets.DHI_PASSWORD }}
+      
+      - name: Login to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          platforms: linux/amd64
+          tags: ghcr.io/${{ github.repository_owner }}/hub-chatbot:${{ needs.get-tag.outputs.version }}
+          context: ./tools/chatbot
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  image-security-scan:
+    name: Scan Chatbot Image
+    needs: [get-tag, build-image]
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+      
+      - name: Login to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      
+      - name: Scan Docker image
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          image-ref: ghcr.io/${{ github.repository_owner }}/hub-chatbot:${{ needs.get-tag.outputs.version }}
+          format: 'sarif'
+          output: 'trivy-chatbot-image.sarif'
+          severity: 'HIGH,CRITICAL'
+          exit-code: '1'
+          trivyignores: 'tools/chatbot/.trivyignore'
+      
+      - name: Upload image scan results to GitHub Security tab
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-chatbot-image.sarif'
+          category: 'trivy-chatbot-image'
+      
+      - name: Upload image scan reports as artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-reports-chatbot
+          path: '*.sarif'
+          retention-days: 30

tools/chatbot/Dockerfile

@@ -8,7 +8,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     UV_LINK_MODE=copy
 
 # Install uv
-RUN apt-get update && apt-get install -y curl ca-certificates && \
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && \
     curl -LsSf https://astral.sh/uv/install.sh | sh && \
     mv /root/.local/bin/uv /usr/local/bin/uv && \
     rm -rf /var/lib/apt/lists/*