t.behrendt
81eda53a59
CD / Release (push) Successful in 4s
As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised. Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date. Reviewed-on: #54 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
25 lines
742 B
JSON
25 lines
742 B
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"local>t.behrendt/renovate-configs:common",
|
|
"local>t.behrendt/renovate-configs:action"
|
|
],
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Update Trivy docker image",
|
|
"managerFilePatterns": ["/(^|/)setup-db/action\\.ya?ml$/"],
|
|
"datasourceTemplate": "docker",
|
|
"matchStrings": [
|
|
"default:\\s*\"(?<depName>ghcr\\.io/aquasecurity/trivy):(?<currentValue>[\\d\\.]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\""
|
|
]
|
|
}
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"matchManagers": ["dockerfile", "kubernetes", "helmfile", "helm-values"],
|
|
"ignorePaths": ["get-images-from-files/test*"]
|
|
}
|
|
]
|
|
}
|