🌱 Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action

[chrischdi]

What this PR does / why we need it:

Adds:

• verify-govulncheck target, to scan the code via govulncheck
• verify-vulnerabilities target which runs ./hack/verify-vulnerabilities.sh
  • Runs make verify-container-images
  • Runs make verify-govulncheck
  • Exit code is 1 if one or both targets report vulnerabilities or errors
• Use verify-vulnerabilities in scan action instead of verify-container-images

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #9091

[chrischdi]

/hold

Want to check if it works like this for submodules

[chrischdi]

/hold cancel

We have to run it on a per-module base.

Added all modules to make-govulncheck.

[sbueringer]

Just one nit otherwise lgtm from my side

[sbueringer]

/assign @vincepri
for another review

[chrischdi]

@vincepri : kindly asking for another look if you find some time :-)

[sbueringer]

I'll merge it for now so we can get some experience.

If there are further comments let's open a follow-up PR.

I think there were no general objections

/lgtm
/approve

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 48c20f9b67f8adef679a49b898fda363f337eff0

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chrischdi]

/cherry-pick release-1.5

[chrischdi]

/cherry-pick release-1.4

[k8s-infra-cherrypick-robot]

@chrischdi: #9144 failed to apply on top of branch "release-1.5":

Applying: Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action
Using index info to reconstruct a base tree...
A	.github/workflows/weekly-image-scan.yaml
M	Makefile
M	docs/release/release-tasks.md
Falling back to patching base and 3-way merge...
Auto-merging docs/release/release-tasks.md
CONFLICT (content): Merge conflict in docs/release/release-tasks.md
Auto-merging Makefile
CONFLICT (rename/rename): Rename ".github/workflows/weekly-image-scan.yaml"->".github/workflows/scan.yml" in branch "HEAD" rename ".github/workflows/weekly-image-scan.yaml"->".github/workflows/weekly-security-scan.yaml" in "Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action"
Auto-merging .github/workflows/scan.yml and .github/workflows/weekly-security-scan.yaml, both renamed from .github/workflows/weekly-image-scan.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-infra-cherrypick-robot]

@chrischdi: #9144 failed to apply on top of branch "release-1.4":

Applying: Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action
Using index info to reconstruct a base tree...
A	.github/workflows/weekly-image-scan.yaml
M	Makefile
M	docs/release/release-tasks.md
M	hack/verify-container-images.sh
Falling back to patching base and 3-way merge...
Auto-merging hack/verify-container-images.sh
Auto-merging docs/release/release-tasks.md
CONFLICT (content): Merge conflict in docs/release/release-tasks.md
Auto-merging Makefile
CONFLICT (rename/rename): Rename ".github/workflows/weekly-image-scan.yaml"->".github/workflows/scan.yml" in branch "HEAD" rename ".github/workflows/weekly-image-scan.yaml"->".github/workflows/weekly-security-scan.yaml" in "Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action"
Auto-merging .github/workflows/scan.yml and .github/workflows/weekly-security-scan.yaml, both renamed from .github/workflows/weekly-image-scan.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add verify-govulncheck and verify-vulnerabilities targets and integrate to scan action
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.4

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[chrischdi]

/area ci