wiz cli CHEF-32378

[vipin230]

Description

This pull request introduces a reusable workflow for building Docker images and integrates it into the main CI pipeline, enabling downstream security scans (Grype and Wiz) to consume a prebuilt Docker image artifact. It also adds a new Wiz CLI security scan workflow and updates the Grype workflow to optionally use prebuilt images, streamlining the image build and scan process for improved efficiency and consistency.

Key changes include:

Docker Image Build and Artifact Handling

• Added .github/workflows/build-docker-image.yml, a reusable workflow that builds Docker images using one of three strategies (custom script, Makefile target, or standard Docker build), saves the image(s) as a tarball, and uploads it as an artifact for downstream jobs.
• Updated .github/workflows/ci-main-pull-request.yml to use the new build-docker-image workflow when Grype or Wiz scans are enabled, and to pass the resulting artifact and image names to downstream scan jobs.

Security Scans Integration

• Added .github/workflows/wiz.yml, a reusable workflow for running Wiz CLI container image scans. It supports scanning prebuilt Docker images, failing the build on policy or severity violations, and uploading scan results as artifacts.
• Enhanced .github/workflows/grype.yml to accept prebuilt Docker image artifacts and image names as inputs, allowing it to skip the build step if provided. The workflow now supports loading and scanning prebuilt images, improving scan performance and reliability. [1] [2] [3] [4]
• Updated .github/workflows/ci-main-pull-request.yml to add new inputs for enabling/disabling Wiz scans and controlling failure behavior based on Wiz scan results.

These changes make the CI pipeline more modular and efficient by decoupling image building from scanning, and by supporting both Grype and Wiz security scans using a common prebuilt Docker image artifact.

Related Issue

https://progresssoftware.atlassian.net/browse/CHEF-32378

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.