First attempt using aquasecurity/trivy-action to scan for CVEs during build. #3461
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -397,11 +397,33 @@ jobs: | |||||
| name: session-build-${{ matrix.sys.os }} | ||||||
| path: build/ | ||||||
|
|
||||||
| scan: | ||||||
| name: Scan | ||||||
| needs: | ||||||
| - os_specific | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - name: Download All Build Session Artifacts | ||||||
| uses: actions/download-artifact@v2 | ||||||
| with: | ||||||
| path: build/ | ||||||
|
|
||||||
| - name: Scan for CVEs | ||||||
| if: runner.os == 'Linux' | ||||||
| uses: aquasecurity/[email protected] | ||||||
| with: | ||||||
|
There was a problem hiding this comment. Could you try adding |
||||||
| scan-type: rootfs | ||||||
| scan-ref: build | ||||||
| list-all-pkgs: true | ||||||
| ignore-unfixed: true | ||||||
|
There was a problem hiding this comment.
Suggested change
If I understand this correctly There was a problem hiding this comment. No, this will ignore any CVEs that do not have fixes. We currently have an unfixed CVE (archiver/v3 does not have a fix, so there's no safe version we can update to). Without this option, the check will fail and we will have to force PRs to merge. There was a problem hiding this comment. Ahh I see.. ok yeah that makes sense 👍 |
||||||
| format: table | ||||||
| exit-code: 1 | ||||||
|
|
||||||
| # === Deploy job (runs once with combined artifacts from OS specific job) === | ||||||
| deploy: | ||||||
| name: Deploy | ||||||
| needs: | ||||||
| - scan | ||||||
| runs-on: ubuntu-20.04 | ||||||
| env: | ||||||
| ACTIVESTATE_CI: true | ||||||
|
|
@@ -424,7 +446,7 @@ jobs: | |||||
| name: Install Go | ||||||
| uses: actions/setup-go@v3 | ||||||
| with: | ||||||
| go-version: 1.22.x | ||||||
|
There was a problem hiding this comment. Should update the matrix version instead. There was a problem hiding this comment. The matrix does not exist for this job. Our action linter caught this. |
||||||
|
|
||||||
| - # === Install State Tool === | ||||||
| name: Install State Tool | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add the same
ifconditional as deploy. Which has it only run on nightly and release branches.eg.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You missed my comment about this:
Until that is addressed, I am not okay with doing what you requested.