da306b68fd
build: Migrate to GitHub CLI tool ( #6329 )
...
The `hub` tool is deprecated in favor of the GitHub CLI and
is removed from GitHub's action runner images.
Fixes : #6326
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com >
2023-10-19 10:23:54 +02:00
b07e60a9f8
nightly: skip Fri/Sat night ( #6242 )
...
It's unlikely that anyone is looking at the results when there's a
fresh run's results (of Sunday) awaiting you on Monday.
Signed-off-by: Stephan Renatus <stephan@styra.com >
2023-09-23 21:29:49 +02:00
c7234e85fa
build(deps): bump docker/setup-qemu-action from 2 to 3
...
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) from 2 to 3.
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2...v3 )
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-09-12 14:01:15 -07:00
d178ed7921
build(deps): bump docker/setup-buildx-action from 2 to 3
...
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) from 2 to 3.
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/v2...v3 )
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-09-12 13:37:52 -07:00
e3ba8080ba
build(deps): bump actions/checkout from 3 to 4 ( #6210 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-09-05 13:52:42 +02:00
784dfc1648
build(deps): bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 ( #6207 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.11.2 to 0.12.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.11.2...0.12.0 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-09-04 13:21:02 +02:00
1e4f120beb
[docs] Update integrations, organisations and softwares to have pages ( #6158 )
...
This PR makes it possible to browse integrations, organizations and related softwares. Previously, these details were only available as modals on the ecosystem page.
There are also some changes to the policy enforcement on the docs content, the validation rules are much the same but have been updated to reflect that the content is stored in a new place. I have used some generated JSON in Hugo rather than using GitHub api requests to validate the files since it's A) faster, B) I think more simple, and C) easier to get Hugo to process the markdown frontmatter.
Much of the hackery in this PR (Hugo function partials to look up sets of files and get the data from them) is due to the fact that we can't use Hugo's native sections feature. All of our content is nested under docs, this means that all our pages are in the same section so custom lookups have been implemented as function partials instead to work around this.
Signed-off-by: Charlie Egan <charlie@styra.com >
2023-08-17 16:09:33 +01:00
1fc95f43f8
deps: Bump OpenTelemetry 1.16.0 ( #6062 )
...
Fixes #6003
* test/e2e: fix distributed tracing tests
Fixes provided by @zregvart, thank you!
* build: give up golang 1.18, it blocks OTel 1.16.0
Signed-off-by: Greg Haskins <greg@manetu.com >
Signed-off-by: Stephan Renatus <stephan@styra.com >
Co-authored-by: Greg Haskins <greg@manetu.com >
Co-authored-by: Zoran Regvart <zoran@regvart.com >
2023-06-30 09:36:03 +02:00
39c3ab43f7
.github/workflows: Increase timeout for benchmark test
...
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com >
2023-06-23 13:19:13 -07:00
34b4fa9ffb
build(deps): bump aquasecurity/trivy-action from 0.11.0 to 0.11.2 ( #6002 )
2023-06-12 12:10:33 +00:00
e663e1c5b3
build(deps): bump aquasecurity/trivy-action from 0.10.0 to 0.11.0 ( #5978 )
2023-06-06 12:09:52 +00:00
6a1af0fdeb
build(deps): bump aquasecurity/trivy-action from 0.9.2 to 0.10.0
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.9.2 to 0.10.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.9.2...0.10.0 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-04-19 08:54:00 -07:00
86b37407aa
build(deps): bump actions/setup-go from 3 to 4 ( #5764 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 3 to 4.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-03-16 16:29:00 +01:00
8aa60e8b52
build(deps): bump aquasecurity/trivy-action from 0.9.1 to 0.9.2
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.9.1...0.9.2 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-03-07 08:40:39 -08:00
c9ec05d3fe
bump: go 1.19.5 -> 1.20.1
...
This PR bumps go to 1.20.1 (https://go.dev/doc/go1.20 ) which
addresses the following vulnerabilities:
https://pkg.go.dev/vuln/GO-2023-1571
https://pkg.go.dev/vuln/GO-2023-1570
https://pkg.go.dev/vuln/GO-2023-1568
As part of the migration, general Golang
stdlib deprecations and test failures were addressed as well.
Some of those changes are:
* Bump golangci-lint for support with go1.20
* Migrate rand.Seed() calls to the newer rand.New(rand.NewSource(seed))
Co-authored-by: Stephan Renatus <stephan@styra.com >
Co-authored-by: Philip Conrad <philipaconrad@gmail.com >
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com >
2023-02-21 13:51:23 -08:00
580bbc2967
build(deps): bump aquasecurity/trivy-action from 0.9.0 to 0.9.1
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.9.0 to 0.9.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.9.0...0.9.1 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-02-10 09:21:23 -08:00
332061678d
build(deps): bump aquasecurity/trivy-action from 0.8.0 to 0.9.0
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.8.0 to 0.9.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.8.0...0.9.0 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2023-02-02 08:44:53 -08:00
22340a9e02
Revert "ci: temporary workaround for golang proxy/sumdb bug ( #5463 )" ( #5469 )
...
This reverts commit 44c78a9e74https://github.com/golang/go/issues/57185
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-12-09 20:53:40 +01:00
44c78a9e74
ci: temporary workaround for golang proxy/sumdb bug ( #5463 )
...
As of last night, we see this error -- reproducible locally:
$ go install golang.org/x/vuln/cmd/govulncheck@latest
go: golang.org/x/vuln/cmd/govulncheck@latest: no matching versions for query "latest"
with the env vars set to bypass the infrastructure, it'll work:
$ GOPROXY=direct GOSUMDB=off go install golang.org/x/vuln/cmd/govulncheck@latest
go: downloading golang.org/x/vuln v0.0.0-20221208180742-f2dca5ff4cc3
go: downloading golang.org/x/tools v0.4.0
So let's do that for now.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-12-09 09:56:12 +01:00
3272e52cc7
ci: fix nightly job ( #5413 )
...
This has been broken for a few nights after moving the performance job.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-11-22 14:09:32 +01:00
976bbec765
ci: move performance to nightly tests ( #5405 )
...
Few people ever look at the output of this, and yet everyone has to wait
for it. Let's change that.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-11-18 13:49:07 +01:00
afe58b45be
ci/pull-request: change action used for wasm filter ( #5365 )
...
Fixing recent failures we've had with the other action.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-11-07 14:56:58 +01:00
1cf2c781b6
workflow/post-tag: fix typo ( #5350 )
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-11-03 09:39:49 +01:00
c2c9e536fc
build(deps): bump aquasecurity/trivy-action from 0.7.1 to 0.8.0 ( #5331 )
2022-11-01 11:45:53 +00:00
a6bc34d64d
ci(pull-request): setup-opa@v1 -> setup-opa@v2 ( #5302 )
...
Resolves https://github.com/open-policy-agent/setup-opa/issues/18 for the usage in this repo.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-10-25 11:53:35 +02:00
482769dd12
nightly: address recent findings, update trivyignore ( #5287 )
...
This is a bit of a bag of a few smaller things:
* workflows/nightly: skip imported gqlparser package.json
It is not used anywhere.
* .trivyignore: remove docker CVE
This has been bumped away when updating ORAS.
* website/livescripts: bump minimatch
This also updated the lockfile version... I think that's OK.
* workflows/pull-request: don't setup opa for docker image smoke test
* address netlify ignore script failure on large output
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-10-21 12:06:38 +02:00
9677a09d9e
workflow: use GITHUB_OUTPUT, not ::set-output ( #5245 )
...
https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-10-13 14:00:00 +02:00
a226f4f1ed
build(deps): bump tj-actions/changed-files from 32.0.0 to 32.1.0 ( #5244 )
...
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files ) from 32.0.0 to 32.1.0.
- [Release notes](https://github.com/tj-actions/changed-files/releases )
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md )
- [Commits](https://github.com/tj-actions/changed-files/compare/v32.0.0...v32.1.0 )
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-13 13:49:33 +02:00
4ea5c0f1b9
build(deps): bump tj-actions/changed-files from 29.0.9 to 32.0.0 ( #5215 )
...
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files ) from 29.0.9 to 32.0.0.
- [Release notes](https://github.com/tj-actions/changed-files/releases )
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md )
- [Commits](https://github.com/tj-actions/changed-files/compare/v29.0.9...v32.0.0 )
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-06 14:04:07 +02:00
584caa3cfe
build(deps): bump tj-actions/changed-files from 29.0.7 to 29.0.9 ( #5158 )
2022-09-20 11:41:49 +00:00
91f641be2c
build(deps): bump tj-actions/changed-files from 29.0.5 to 29.0.7 ( #5138 )
2022-09-14 11:44:40 +00:00
478812c408
build(deps): bump tj-actions/changed-files from 29.0.4 to 29.0.5 ( #5132 )
2022-09-13 11:41:43 +00:00
31518a1ee0
ci(nightly): send notifications for trivy and govulncheck checks ( #5116 )
...
Since one of them had been failing for two weeks, unnoticed...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-09-09 14:12:03 +02:00
813a234f3c
build(deps): bump tj-actions/changed-files from 29.0.3 to 29.0.4 ( #5113 )
2022-09-08 12:12:09 +00:00
7a63889ed1
ci: try govulncheck from nightly ( #5103 )
...
See https://go.dev/security/vuln/ for details.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-09-08 09:14:02 +02:00
a2d855f3d9
build(deps): bump tj-actions/changed-files from 29.0.2 to 29.0.3 ( #5092 )
...
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files ) from 29.0.2 to 29.0.3.
- [Release notes](https://github.com/tj-actions/changed-files/releases )
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md )
- [Commits](https://github.com/tj-actions/changed-files/compare/v29.0.2...v29.0.3 )
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-09-05 18:04:01 +02:00
287c9b9923
ci: re-enable wasm lib tests ( #5076 )
...
It had slipped my mind that those need docker, too. Previously, I've disabled
docker for those tests to avoid having them rebuild their wasm artifacts.
The wasm/Makefile change is superficial, and just meant to ensure we run this
test while the PR is WIP. Changes to .github/workflow/* alone won't trigger the
wasm tests.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-09-01 09:40:57 +02:00
82d2264fbf
build(deps): bump tj-actions/changed-files from 29.0.1 to 29.0.2 ( #5062 )
...
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files ) from 29.0.1 to 29.0.2.
- [Release notes](https://github.com/tj-actions/changed-files/releases )
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md )
- [Commits](https://github.com/tj-actions/changed-files/compare/v29.0.1...v29.0.2 )
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-29 13:28:40 +02:00
27521bb6e1
build(deps): bump tj-actions/changed-files from 29.0.0 to 29.0.1 ( #5055 )
...
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files ) from 29.0.0 to 29.0.1.
- [Release notes](https://github.com/tj-actions/changed-files/releases )
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md )
- [Commits](https://github.com/tj-actions/changed-files/compare/v29.0.0...v29.0.1 )
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-26 13:25:49 +02:00
815fc424c6
build(deps): bump tj-actions/changed-files from 28.0.0 to 29.0.0 ( #5047 )
...
Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files ) from 28.0.0 to 29.0.0.
- [Release notes](https://github.com/tj-actions/changed-files/releases )
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md )
- [Commits](https://github.com/tj-actions/changed-files/compare/v28.0.0...v29.0.0 )
---
updated-dependencies:
- dependency-name: tj-actions/changed-files
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-24 14:03:05 +02:00
70e90bdbbb
ci: remove quick-fuzz, guard wasm tests on changed files, limit concurrency ( #5030 )
...
* ci: remove quick-fuzz, guard wasm tests on changed files
This is a first step into running less things all the time that don't need to
be run all the time.
It's a heuristic, and as such fallible: there could always be changes that
break something in the wasm code path, because I have forgotten that there's a
dependency of some sort.
Removing the quick-fuzz target, it's never brought any issues up; and still
runs in nightly tests.
* ci: cancel previous run for PRs
From https://stackoverflow.com/a/72408109/993018 .
* ci: avoid rebuilding wasm
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-08-22 16:28:45 +02:00
1fca607758
ci: ubuntu 18.04 -> 22.04 ( #5031 )
...
ubuntu-18.04 was causing our builds to break, in a scheduled brownout.
All references to either ubuntu-latest or ubuntu-18.04 are now ubuntu-22.04.
(I figured it's better to control the version in all places.)
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-08-22 15:07:28 +02:00
40b1bad429
build(deps): bump aquasecurity/trivy-action from 0.7.0 to 0.7.1 ( #5024 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.7.0 to 0.7.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.7.0...0.7.1 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-19 13:20:17 +02:00
47c8256b60
build(deps): bump aquasecurity/trivy-action from 0.6.2 to 0.7.0 ( #5017 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.6.2 to 0.7.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.6.2...0.7.0 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-17 13:20:33 +02:00
27274e08b6
build: use go 1.19, drop go 1.16 ( #5013 )
...
With this, we'll build our container images and binaries using golang 1.19.
Also, the go.mod version stanza is increased, letting us use go1.17+ features.
I had to run
go mod tidy -go=1.16 && go mod tidy -go=1.17
to get rid of `go mod tidy` related messages, and ran `go mod vendor`
afterwards.
* prometheus: adjust tests for new go1.19 metrics
Note that the new metrics only appear when using the Go runtime of 1.19. So,
we do the same we've done before when 1.17 brought in new metrics: add them
to the tests, and use build flags to not run the tests in the previous versions.
When the bump of github.com/prometheus/go_client to 1.13.0 was merged, it was
properly tested with all of 1.17 and 1.18. So, the previously expected metrics
should be there when using OPA from 1.17 or 1.18.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-08-15 18:05:55 +02:00
b03c188907
build(deps): bump aquasecurity/trivy-action from 0.6.1 to 0.6.2 ( #4969 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.6.1...0.6.2 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-11 12:31:46 -04:00
eff91f755c
build(deps): bump aquasecurity/trivy-action from 0.6.0 to 0.6.1 ( #4941 )
2022-07-27 11:33:42 +00:00
c981cc9bd0
ci(nightly): various trivy-related tweaks ( #4935 )
...
1. only check the edge-static image
There are a bunch of libc-related findings that are hard to address, and
likely not relevant for us: for example, Go will not use glibc's regexp
engine, even if linked against libc.
2. pull the image before checking it
I've noticed locally that `trivy image` will just use whatever image it
finds under the mentioned tag. So we pull first to ensure that we actually
scan the right 'edge' image.
3. split jobs
Before, the scan-repo step wouldn't ever happen if scan-image failed. Let's
do them both all the time instead.
4. for the repo scan, ignore go.mod files of the dependencies -- there's little
we can do about, say, grpc referencing a vulnerable yaml.v2 dep in its
go.mod. And there should also be little harm in it, since we're using a more
recent version in our go.mod.
5. Updated .trivyignore with recent, new, findings.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-07-25 12:00:53 +02:00
9f9fbb91e9
build(deps): bump aquasecurity/trivy-action from 0.5.1 to 0.6.0 ( #4929 )
...
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) from 0.5.1 to 0.6.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.5.1...0.6.0 )
---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-22 15:04:04 +02:00
eef861dec6
CI: remove trivy from PRs, add CVE-2022-1996 to ignores ( #4867 )
...
This is breaking contributions when there is something new in trivy's
databases. That's unfortunate, and will be turned off by this commit.
We're still running the checks nightly, and that's good enough for raising the
maintainers' attention.
* .trivyignore: add CVE-2022-1996
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2022-07-11 09:45:27 +02:00
Ashutosh Narkar