Add workflow for weekly CVE reports

.github/workflows/cve-notifier.yml

@@ -0,0 +1,60 @@
+name: CVE Notifier
+
+on:
+  schedule:
+    # Every Monday at 08:00 UTC
+    - cron: "0 8 * * 1"
+  # Allow manual trigger for on-demand triggers or debug
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  cve-notifier:
+    name: Run CVE Notifier
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout github-actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Checkout CVE notifier tool
+      # It is expected to checkout it from frawless user
+      - name: Checkout frawless/cve-notifier
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: frawless/cve-notifier
+          ref: 39bd3f7b0339578fb83b9e6d7029fd8e6b361a43
+          path: cve-notifier
+
+      - name: Copy projects.yaml config
+        run: cp configs/cve-notifier-projects.yaml cve-notifier/config/projects.yaml
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+
+      - name: Install Poetry
+        run: pip install poetry
+
+      - name: Install dependencies
+        working-directory: cve-notifier
+        run: poetry install --only main
+
+      - name: Run CVE Notifier
+        working-directory: cve-notifier
+        run: |
+          poetry run security-report run \
+            --config config/projects.yaml \
+            --output-dir ./output \
+            --refresh \
+            --snyk \
+            --fossa \
+            --send-slack \
+            --slack-channel "${{ secrets.SLACK_WEBHOOK_URL }}"
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+          SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}

configs/cve-notifier-projects.yaml

@@ -0,0 +1,114 @@
+schemaVersion: 2
+
+report:
+  windowDays: 7
+  containerArchitecture: amd64
+
+providers:
+  fossa:
+    # Strimzi team id
+    team: "46084"
+
+repositories:
+
+  strimzi-kafka-operator:
+    github: strimzi/strimzi-kafka-operator
+    projectName: strimzi-kafka-operator
+    containers:
+      images:
+        - name: strimzi/operator
+          component: cluster-operator
+          fossaProject: operator
+        - name: strimzi/kafka
+          component: kafka
+          fossaProject: kafka
+        - name: strimzi/maven-builder
+          component: maven-builder
+          fossaProject: maven-builder
+        - name: strimzi/buildah
+          component: buildah
+          fossaProject: buildah
+
+    snyk:
+      mavenGroupIds:
+        - io.strimzi
+      targetGroups:
+        - id: main
+          displayName: "main / latest"
+          mavenRef: main
+          containerRef: latest
+        - id: release-1.3
+          displayName: "1.3.x / 1.3.0"
+          mavenRef: release-1.3.x
+          containerRef: 1.3.0
+
+    fossa:
+      mavenProject: custom+162/operators
+      targetGroups:
+        - id: main
+          displayName: "main / latest"
+          mavenRef: main
+          containerRef: latest
+        - id: release-1.3
+          displayName: "1.3.x / 1.3.0"
+          mavenRef: release-1.3.x
+          containerRef: 1.3.0
+
+  strimzi-kafka-bridge:
+    github: strimzi/strimzi-kafka-bridge
+    projectName: strimzi-kafka-bridge
+    containers:
+      images:
+        - name: strimzi/kafka-bridge
+          component: kafka-bridge
+          fossaProject: kafka-bridge-container
+    snyk:
+      mavenProjects:
+        - io.strimzi:kafka-bridge
+      targetGroups:
+        - id: main
+          displayName: "main / latest"
+          mavenRef: main
+          containerRef: latest
+        - id: release-1.2
+          displayName: "1.2.x / 1.2.0"
+          mavenRef: release-1.2.x
+          containerRef: 1.2.0
+
+    fossa:
+      mavenProject: custom+162/kafka-bridge
+      targetGroups:
+        - id: main
+          displayName: "main / latest"
+          mavenRef: main
+          containerRef: latest
+        - id: release-1.2
+          displayName: "1.2.x / 1.2.0"
+          mavenRef: release-1.2.x
+          containerRef: 1.2.0
+          fossaBranch: 1.2.0
+
+  drain-cleaner:
+    github: strimzi/drain-cleaner
+    projectName: drain-cleaner
+    containers:
+      images:
+        - name: strimzi/drain-cleaner
+          component: drain-cleaner
+          fossaProject: drain-cleaner-container
+    snyk:
+      mavenProjects:
+        - io.strimzi:strimzi-drain-cleaner
+      targetGroups:
+        - id: main
+          displayName: "main / latest"
+          mavenRef: main
+          containerRef: latest
+
+    fossa:
+      mavenProject: custom+162/drain-cleaner
+      targetGroups:
+        - id: main
+          displayName: "main / latest"
+          mavenRef: main
+          containerRef: latest