As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised.
Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date.
Reviewed-on: #54
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
Excluding the test files `test-compose.yaml`, `test-deployment.yaml`, `test-values-helmfile.yaml`, and `test.Dockerfile` from dependabot updates.
Reviewed-on: t.behrendt/trivy-actions#39
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
Welcome to [Renovate](https://github.com/renovatebot/renovate)! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.
🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.
---
### Detected Package Files
* `.gitea/workflows/cd.yaml` (github-actions)
* `.gitea/workflows/ci.yaml` (github-actions)
* `setup-trivy/action.yaml` (github-actions)
### What to Expect
It looks like your repository dependencies are already up-to-date and no Pull Requests will be necessary right away.
---
❓ Got questions? Check out Renovate's [Docs](https://docs.renovatebot.com/), particularly the Getting Started section.
If you need any further assistance then you can also [request help here](https://github.com/renovatebot/renovate/discussions).
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-config-hash:94693a990c975907e7f13da3309b9d56ba02b3983519b41786edf5cf031e457c-->
Reviewed-on: t.behrendt/trivy-actions#2
Co-authored-by: Renovate Bot <renovate@t00n.de>
Co-committed-by: Renovate Bot <renovate@t00n.de>
t.behrendt
renovate-bot