This is a bit of a bag of a few smaller things:
* workflows/nightly: skip imported gqlparser package.json
It is not used anywhere.
* .trivyignore: remove docker CVE
This has been bumped away when updating ORAS.
* website/livescripts: bump minimatch
This also updated the lockfile version... I think that's OK.
* workflows/pull-request: don't setup opa for docker image smoke test
* address netlify ignore script failure on large output
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
1. only check the edge-static image
There are a bunch of libc-related findings that are hard to address, and
likely not relevant for us: for example, Go will not use glibc's regexp
engine, even if linked against libc.
2. pull the image before checking it
I've noticed locally that `trivy image` will just use whatever image it
finds under the mentioned tag. So we pull first to ensure that we actually
scan the right 'edge' image.
3. split jobs
Before, the scan-repo step wouldn't ever happen if scan-image failed. Let's
do them both all the time instead.
4. for the repo scan, ignore go.mod files of the dependencies -- there's little
we can do about, say, grpc referencing a vulnerable yaml.v2 dep in its
go.mod. And there should also be little harm in it, since we're using a more
recent version in our go.mod.
5. Updated .trivyignore with recent, new, findings.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This is breaking contributions when there is something new in trivy's
databases. That's unfortunate, and will be turned off by this commit.
We're still running the checks nightly, and that's good enough for raising the
maintainers' attention.
* .trivyignore: add CVE-2022-1996
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This uses Trivy to scan both the Git repo, as well as the generated
container image for vulnerabilities. It leverages Trivy's GitHub action
[1]. Currently, it's set to alert on `CRITICAL` and `HIGH`
vulnerabilities only.
[1] https://github.com/aquasecurity/trivy-action
This adds a section in the developer docs, as well as comments on the GitHub workflows.
Signed-off-by: Juan Antonio Osorio <juan.osoriorobles@eu.equinix.com>
Stephan Renatus