As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised.
Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date.
Reviewed-on: #54
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
Using the "latest" released version of Trivy as the default version.
We always first resolve latest to an actual version to allow the cache to work properly.
Reviewed-on: t.behrendt/trivy-actions#15
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
Mapping x86_64 to "64bit" and aarch64 to "ARM64" as this is how Trivy names their releases.
Adjusted CICD to test-run both amd64 and arm64 versions.
Reviewed-on: t.behrendt/trivy-actions#14
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
t.behrendt