Repository navigation
Setup trivy scanner in ci - #527
Conversation
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: 'function-mesh-operator:latest' |
There was a problem hiding this comment.
one thing that may need to a discussion is the severity, the default value is UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL, do we need to ignore some of them, like UNKNOWN, LOW severity vulnerabilities?
@streamnative/serverless @hpvd
There was a problem hiding this comment.
great to see you are taking action on this!
would vote for suppress nothing. It mostly isn't much work to update a dependency for the benefit of better security.
If there are vulnerabilities with no fix available yet, one could think of suppressing them until a fix is available...
(but one have to take care to not suppress them forever)
One could also think one step further, and not only update dependencies with known security flaws, but directly always when a new version of a dependency is released.
This could be comfortably done, using dependabot and let this tool automatically start a new pull request for update
see: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates
With this, trivy will have less findings and one is often one step ahead of security problems...
Master Issue: #371
Motivation
Add trivy scanner to avoid import security vulnerabilities
Modifications
Add trivy scanner in ci
Verifying this change
Make sure that the change passes the CI checks.
This change is a trivial rework / code cleanup without any test coverage.
Documentation
Check the box below.
Need to update docs?
doc-required(If you need help on updating docs, create a doc issue)
no-need-docci change
doc(If this PR contains doc changes)