t.behrendt/sec-actions
0
0
Fork 0
Code Issues 2 Pull Requests Actions Activity

refactor(setup-db): to run trivy in docker #54

Merged
t.behrendt merged 1 commits from feat-wrap-trivy-runtime-in-docker into main 2026-04-10 18:43:03 +02:00
Conversation 1 Commits 1 Files Changed 3
+42 -5
t.behrendt commented 2026-04-10 18:05:24 +02:00
Owner
Copy Link
Copy Source

As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised.
Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date.

As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised. Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date.
t.behrendt added 1 commit 2026-04-10 18:34:08 +02:00
feat: harden setup-db action
CI / Test Get Images From Files (pull_request) Successful in 4s
Details
CI / Test Setup Trivy amd64 (pull_request) Successful in 5s
Details
CI / Test Merge SARIF Files (pull_request) Successful in 5s
Details
CI / Test Setup Trivy arm64 (pull_request) Successful in 39s
Details
CI / Test Setup DB (pull_request) Successful in 1m12s
Details
efef29591b
t.behrendt force-pushed feat-wrap-trivy-runtime-in-docker from 0946c898b6 to efef29591b 2026-04-10 18:34:08 +02:00 Compare
t.behrendt changed title from feat!: increase trivy security to refactor(setup-db): to run trivy in docker 2026-04-10 18:37:21 +02:00
t.behrendt requested review from branch-buddy 2026-04-10 18:39:00 +02:00
branch-buddy approved these changes 2026-04-10 18:41:36 +02:00
branch-buddy left a comment
Collaborator
Copy Link
Copy Source

The changes align with the PR title and description, implementing Docker-based Trivy isolation with digest pinning. Security measures like --read-only, --cap-drop, and --security-opt are appropriately applied. Renovate configuration for Trivy image updates is correctly added.

The changes align with the PR title and description, implementing Docker-based Trivy isolation with digest pinning. Security measures like --read-only, --cap-drop, and --security-opt are appropriately applied. Renovate configuration for Trivy image updates is correctly added.
t.behrendt merged commit 81eda53a59 into main 2026-04-10 18:43:03 +02:00
t.behrendt deleted branch feat-wrap-trivy-runtime-in-docker 2026-04-10 18:43:04 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
branch-buddy
Labels
Clear labels
action
automerge
bug
Something is not working
 deps
docker
duplicate
This issue or pull request already exists
 enhancement
New feature
 go
help wanted
Need some help
 invalid
Something is wrong
 k8s
npm
question
More information is needed
 security
wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
branch-buddy renovate-bot t.behrendt
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: t.behrendt/sec-actions#54
Delete Branch "feat-wrap-trivy-runtime-in-docker"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?