[Issue 16] Add Grype for vulnerability scanning

[SammySteiner]

Ticket

• Resolves Add grype for container scanning #16

Changes

• Added .grype.yml file to root directory
• Added .grype.yml to the template-only-bin/install-template.sh file to transfer the .grype.yml file to repos created with the template

Context for reviewers

Tested by running grype locally on database image and application image with and without the .grype.yml file to make sure it was loading and formatted correctly.

Testing

Install and run Grype locally with and without the .grype.yml file ignore to confirm it is working as intended.

[ellery-nava]

Do we need to update the README with any instructions on installing and running Grype?
Should it be run automatically on PRs? Or are we expecting developers to run manually?

[SammySteiner]

Do we need to update the README with any instructions on installing and running Grype?
Should it be run automatically on PRs? Or are we expecting developers to run manually?

I haven't been on a project where developers were running it manually, unless there was a vulnerability identified by the scan. At which point, you can run it locally, but I think most people were relying on the ci pipeline to run when push changes to the PR.

[ellery-nava]

Makes sense - is this adding to the CI workflows part of this ticket? Not familiar with how much comes out of the box usually on Platform projects

[SammySteiner]

Makes sense - is this adding to the CI workflows part of this ticket? Not familiar with how much comes out of the box usually on Platform projects

The ticket referenced the template-nextjs repo's implementation, which only contains the bin script update and the .grype.yml file, it's assuming the ci workflow is coming from the infra repo. So I decided to use that implementation as my guide for how far to take it.

[ellery-nava]

Thanks for all the clarification! Approved

[rocketnova]

LGTM. Thank you!