nightly: address recent findings, update trivyignore (#5287)

This is a bit of a bag of a few smaller things:

* workflows/nightly: skip imported gqlparser package.json
   It is not used anywhere.

* .trivyignore: remove docker CVE
   This has been bumped away when updating ORAS.

* website/livescripts: bump minimatch
   This also updated the lockfile version... I think that's OK.

* workflows/pull-request: don't setup opa for docker image smoke test
* address netlify ignore script failure on large output

Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>

.github/workflows/nightly.yaml

@@ -123,7 +123,7 @@ jobs:
           format: table
           exit-code: '1'
           ignore-unfixed: true
-          skip-dirs: vendor/ # don't check go deps' go.mod files
+          skip-dirs: vendor/,internal/gqlparser/validator/imported/
           severity: CRITICAL,HIGH
 
       - name: Slack Notification

.github/workflows/pull-request.yaml

@@ -230,9 +230,6 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v3
 
-      - name: Download OPA
-        uses: open-policy-agent/setup-opa@v1
-
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
         with:

.trivyignore

@@ -31,8 +31,5 @@ CVE-2021-25741
 # * github.com/emicklei/go-restful - we don't use its code in our handlers
 CVE-2022-1996
 
-# * github.com/docker/distribution - OCI manifest code isn't used
-GHSA-qq97-vm5h-rrhg
-
 # github.com/dgrijalva/jwt-go -- vulnerable version used by docker/distribution above
 CVE-2020-26160

Makefile

@@ -403,7 +403,9 @@ ifneq ($(GOARCH),arm64) # we build only static images for arm64
 	$(DOCKER) run --platform linux/$* $(DOCKER_IMAGE):$(VERSION)-debug version
 	$(DOCKER) run --platform linux/$* $(DOCKER_IMAGE):$(VERSION)-rootless version
 
-	$(DOCKER) image inspect $(DOCKER_IMAGE):$(VERSION)-rootless | opa eval --fail --format raw --stdin-input 'input[0].Config.User = "1000:1000"'
+	$(DOCKER) image inspect $(DOCKER_IMAGE):$(VERSION)-rootless |\
+	  $(DOCKER) run --interactive --platform linux/$* $(DOCKER_IMAGE):$(VERSION)-rootless \
+	  eval --fail --format raw --stdin-input 'input[0].Config.User = "1000:1000"'
 endif
 	$(DOCKER) run --platform linux/$* $(DOCKER_IMAGE):$(VERSION)-static version
 

build/docs-build-needed.sh

@@ -5,4 +5,4 @@ set -exo pipefail
 # NOTE(sr): we include version because that's what drives releases
 # Makefile and netlify.toml capture when the build infrastructure changes
 # ast/builtins.go and capabilities.json are driving the builtins_metadata.
-git diff --exit-code $CACHED_COMMIT_REF $COMMIT_REF docs/ Makefile build/ netlify.toml ast/builtins.go capabilities.json version/
+git diff --name-only --exit-code $CACHED_COMMIT_REF $COMMIT_REF docs/ Makefile build/ netlify.toml ast/builtins.go capabilities.json version/