🌱 Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action

[chrischdi]

What this PR does / why we need it:

Adds:

• verify-govulncheck target, to scan the code via govulncheck
• verify-vulnerabilities target which runs ./hack/verify-vulnerabilities.sh
  • Runs make verify-container-images
  • Runs make verify-govulncheck
  • Exit code is 1 if one or both targets report vulnerabilities or errors
• Use verify-vulnerabilities in scan action instead of verify-container-images

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #2119

[chrischdi]

/hold

to track and merge core CAPI PR first: kubernetes-sigs/cluster-api#9144

[sbueringer]

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: b8dd4f60473ffc80cae101c4d902e83121d2793a

[sbueringer]

/hold cancel

[chrischdi]

/cherry-pick release-1.8

[k8s-infra-cherrypick-robot]

@chrischdi: once the present PR merges, I will cherry-pick it on top of release-1.8 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[chrischdi]

/cherry-pick release-1.7

[k8s-infra-cherrypick-robot]

@chrischdi: once the present PR merges, I will cherry-pick it on top of release-1.7 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[chrischdi]

/cherry-pick release-1.6

[sbueringer]

@killianmuldoon We'll take a closer look tomorrow, but it looks like we have an issue with the CI env

[sbueringer]

To unblock this PR (and because it doesn't have any impact on e2e). Let's try

/override pull-cluster-api-provider-vsphere-e2e-main

[k8s-ci-robot]

@sbueringer: Overrode contexts on behalf of sbueringer: pull-cluster-api-provider-vsphere-e2e-main

In response to this:

To unblock this PR. Let's try

/override pull-cluster-api-provider-vsphere-e2e-main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-infra-cherrypick-robot]

@chrischdi: new pull request created: #2214

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-infra-cherrypick-robot]

@chrischdi: #2174 failed to apply on top of branch "release-1.7":

Applying: Add verify-govulncheck target and integrate to scan action
Using index info to reconstruct a base tree...
A	.github/workflows/weekly-image-scan.yaml
M	Makefile
A	docs/release/release-tasks.md
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): docs/release/release-tasks.md deleted in HEAD and modified in Add verify-govulncheck target and integrate to scan action. Version Add verify-govulncheck target and integrate to scan action of docs/release/release-tasks.md left in tree.
Auto-merging Makefile
CONFLICT (content): Merge conflict in Makefile
CONFLICT (rename/delete): .github/workflows/weekly-image-scan.yaml deleted in Add verify-govulncheck target and integrate to scan action and renamed to .github/workflows/scan.yaml in HEAD. Version HEAD of .github/workflows/scan.yaml left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add verify-govulncheck target and integrate to scan action
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-infra-cherrypick-robot]

@chrischdi: #2174 failed to apply on top of branch "release-1.6":

Applying: Add verify-govulncheck target and integrate to scan action
Using index info to reconstruct a base tree...
A	.github/workflows/weekly-image-scan.yaml
M	Makefile
A	docs/release/release-tasks.md
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): docs/release/release-tasks.md deleted in HEAD and modified in Add verify-govulncheck target and integrate to scan action. Version Add verify-govulncheck target and integrate to scan action of docs/release/release-tasks.md left in tree.
Auto-merging Makefile
CONFLICT (content): Merge conflict in Makefile
CONFLICT (rename/delete): .github/workflows/weekly-image-scan.yaml deleted in Add verify-govulncheck target and integrate to scan action and renamed to .github/workflows/scan.yaml in HEAD. Version HEAD of .github/workflows/scan.yaml left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add verify-govulncheck target and integrate to scan action
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-infra-cherrypick-robot]

@chrischdi: #2174 failed to apply on top of branch "release-1.5":

Applying: Add verify-govulncheck target and integrate to scan action
Using index info to reconstruct a base tree...
A	.github/workflows/weekly-image-scan.yaml
M	Makefile
A	docs/release/release-tasks.md
Falling back to patching base and 3-way merge...
CONFLICT (modify/delete): docs/release/release-tasks.md deleted in HEAD and modified in Add verify-govulncheck target and integrate to scan action. Version Add verify-govulncheck target and integrate to scan action of docs/release/release-tasks.md left in tree.
Auto-merging Makefile
CONFLICT (content): Merge conflict in Makefile
CONFLICT (rename/delete): .github/workflows/weekly-image-scan.yaml deleted in Add verify-govulncheck target and integrate to scan action and renamed to .github/workflows/scan.yaml in HEAD. Version HEAD of .github/workflows/scan.yaml left in tree.
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add verify-govulncheck target and integrate to scan action
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sbueringer]

@chrischdi Some cherry-picking for you :)