ci: add trivy scan in ci workflow #403
Conversation
| ignore-unfixed: true | ||
| skip-dirs: design | ||
| scan-ref: '.' | ||
| severity: 'CRITICAL,HIGH' |
There was a problem hiding this comment.
Do you think if it makes sense to exit 1 in case of critical? I am a bit worried that information is lost when we have a green check at the end?
There was a problem hiding this comment.
Not sure I got your suggestion. This setting means that it is going to exit with exit code 1 in case of critical or high vulnerabilities detected.
There was a problem hiding this comment.
Not high but critical.
AFAIU, it currently outputs the scan result and always return success no matter what it found, right?
I am wondering if it makes sense to exit 1 in case of critical one to make it more visible.
There was a problem hiding this comment.
right, yes, I'd leave it for both HIGH and CRITICAL:
| severity: 'CRITICAL,HIGH' | |
| exit-code: '1' | |
| severity: 'CRITICAL,HIGH' |
There was a problem hiding this comment.
I am not sure about high.
For example, right now there is 1 high, and CI will be failing until we resolve it. It could be reasonable when there is a critical one may be.
Total: 1 (HIGH: 1, CRITICAL: 0)
┌──────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├──────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2022-41723 │ HIGH │ 0.4.0 │ 0.7.0 │ golang.org/x/net/http2: avoid quadratic complexity in HPACK │
│ │ │ │ │ │ decoding │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-41723 │
There was a problem hiding this comment.
we should fix it then 😉 #388
There was a problem hiding this comment.
Ok, let's go with that and consider softening later if needed.
Signed-off-by: Philippe Scorsolini <p.scorsolini@gmail.com>
Signed-off-by: Philippe Scorsolini <p.scorsolini@gmail.com>
Description of your changes
Adding a trivy scan to the ci workflow, as already done for Crossplane, crossplane/crossplane#3665.
I have:
make reviewable testto ensure this PR is ready for review.How has this code been tested
Already running on Crossplane.