Try scanning base image

.github/workflows/ci-infra.yml

@@ -5,10 +5,12 @@ on:
     branches:
       - main
     paths:
+      - app/Dockerfile
       - infra/**
       - .github/workflows/ci-infra.yml
   pull_request:
     paths:
+      - app/Dockerfile
       - infra/**
       - test/**
       - .github/workflows/ci-infra.yml

app/Dockerfile

@@ -1,7 +1,7 @@
 # This file is largely based on the template-application-flask Dockerfile and
 # Next.js Docker example: https://github.com/vercel/next.js/blob/canary/examples/with-docker-compose
 # =============================================================================
-FROM node:18-alpine AS base
+FROM node:18-bullseye-slim AS base
 WORKDIR /app
 
 # Install dependencies
@@ -56,9 +56,14 @@ RUN npm run build -- --no-lint
 # Run the Next.js server
 # =====================================
 # Use clean image for release, excluding any unnecessary files or dependencies
-FROM node:18-alpine AS release
+FROM node:18-bullseye-slim AS release
 WORKDIR /app
 
+# As of July 13, 2023, 18-bullseye-slim has a vulnerability in the version of
+# semver that it uses (GHSA-c2qf-rxjj-qqgw). Update npm to avoid the vulnerability
+# being caught in vulnerability scans.
+RUN npm install -g npm@latest
+
 # Don't run production as root
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
@@ -81,4 +86,4 @@ ENV PORT 3000
 
 EXPOSE 3000
 
-CMD ["node", "server.js"]
+CMD ["node", "server.js"]

app/Makefile

@@ -27,6 +27,7 @@ export RUN_UID
 ##################################################
 release-build:
 	docker buildx build \
+	  --target release \
 		--platform=linux/amd64 \
 		--build-arg RUN_USER=$(RUN_USER) \
 		--build-arg RUN_UID=$(RUN_UID) \
@@ -45,4 +46,4 @@ storybook: # Run the Storybook local dev server in Docker
 	docker compose logs --follow storybook
 
 stop:
-	docker-compose down
+	docker-compose down