[K9VULN-2634] ci: test that the Docker container can actually be built and run

[amaanq]

What problem are you trying to solve?

This is a follow-up PR to #600, where we noticed that our Docker container could be failing to build, and CI would not let us know of this failure. Currently, the only time we build the Docker container is when we trigger a release workflow, and not during any commit push or PR, which is not ideal. This should be tested in CI

What is your solution?

I've added a workflow that runs on commit pushes and PRs that builds the Docker container, and verifies the binaries can be executed. The workflow is simple, and involves four steps:

• Check out the repository code
• Set up Rust
• Build the Docker container with the tag "test-image"
• Run this container 3 times one for each of our binaries (datadog-static-analyzer, datadog-static-analyzer-server, and datadog-static-analyzer-git-hook)

Additionally, our release process could run into a situation where our GH release works just fine, but the GHCR workflow fails, thus leading to our release version and container version being out of sync. As such, I've made the docker workflow a pre-requisite for the release job in the release workflow.

A successful run of the workflow can be found here.

A successful run of the release workflow, with the docker build workflow being a required step, can be found here

Alternatives considered

What the reviewer should know

Note that Docker is a preinstalled software in GitHub actions, and we don't need any additional functionality that a specialized action might provide for us, as all we're looking to do is build and run a local container.

If the Docker invocation of the binary fails, then the job does indeed fail, as seen here (this failed because I hadn't passed in --help).

[jasonforal]

Can you please test the release.yml workflow in its entirety and link the result just so we have confidence nothing else was missed during review? Thanks!

[amaanq]

squashing & merging