Resolves REL-100 by calling the security scanner as part of the release pipeline, during the internal image creation time.

@willdollman kindly dropped me some notes on how to use this, notably in this PR I've removed dryRun=true given how this will only be run from the release process. I'm also using a tag with no images listed.

I've added the token will sent me to 1Password under image-scanner-webhook and added a check to ensure it exists when being called.

Will's Notes:

curl --location 'https://incoming.sgdev.org/new-image-scan?images=sourcegraph%2Fgitserver%2Csourcegraph%2Ffrontend&tag=5.3.0&scanType=release&dev=true&dryRun=true' \
--header 'X-Special-Header: <key-shared-in-1password>'

it’s not quite set up for releases yet, but you can play around - results are sent to elastic which you don’t have access to, and there’s no api to get the results

to scan everything at a specific tag, remove the images parameter and set tag to the image tag

dryRun=true will ensure it doesn’t actually run a scan, but will still return a json response - best to leave that enabled while you’re working on it otherwise you’ll trigger lots of scans 😛

Test plan

Ran sg release create --version=auto --pretend to ensure the script still works

Changelog

• Added security scanner to the release pipeline