Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: input to skip Trivy scan #156

Merged
merged 8 commits into from
Sep 19, 2024
Merged

feat: input to skip Trivy scan #156

merged 8 commits into from
Sep 19, 2024

Conversation

pankajmouriyakong
Copy link
Contributor

@pankajmouriyakong pankajmouriyakong commented Sep 19, 2024 •
edited by saisatishkarra
Loading

Input: skip_trivy_scan

  • This new input allows repo owner to choose whether to skip the scan or not.
  • The default is set to 'false' to run the scan by default unless explicitly skipped by setting this to 'true'.
  • Use docker.io instead of ghcr.io registry due to intermittent issue

@pankajmouriyakong pankajmouriyakong requested a review from a team as a code owner September 19, 2024 20:12
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 19, 2024 •
edited
Loading

Luacheck Report

1 files  ±0  1 suites  ±0   0s ⏱️ ±0s
4 tests ±0  4 ✅ ±0  0 💤 ±0  0 ❌ ±0 
8 runs  ±0  8 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 6681ac0. ± Comparison against base commit 6d6e601.

♻️ This comment has been updated with latest results.

@pankajmouriyakong pankajmouriyakong requested a review from a team as a code owner September 19, 2024 20:18
@pankajmouriyakong @saisatishkarra
feat: skip trivy scan
9c8fa73 
* feat(SEC-1211): update semgrep version

* Add a new entry for the Semgrep action under the docker ecosystem

Specify the directory as /security-actions/semgrep to ensure that Dependabot monitors changes to the Semgrep Docker image

The commit-message section uses the prefix semgrep and includes the scope to make it clear in the PR message

Dependabot version updates does not support docker:// hence remove the use of this URI

Ref: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#github-actions

* syntax fix

* syntax fix

* syntax fix

* syntax fix

* test

* test

* removed the semgrep package-ecosystem

---------

Co-authored-by: saisatishkarra <[email protected]>
@saisatishkarra saisatishkarra force-pushed the feat/skip-trivy-scans branch 2 times, most recently from 225745e to 78b08a8 Compare September 19, 2024 22:16
saisatishkarra
saisatishkarra approved these changes Sep 19, 2024
View reviewed changes
Copy link
Collaborator

@saisatishkarra saisatishkarra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

security-actions/scan-docker-image/action.yml Outdated Show resolved Hide resolved
security-actions/scan-docker-image/action.yml Outdated Show resolved Hide resolved
security-actions/scan-docker-image/action.yml Outdated Show resolved Hide resolved
@saisatishkarra saisatishkarra merged commit ecbcd70 into main Sep 19, 2024
12 checks passed
@saisatishkarra saisatishkarra deleted the feat/skip-trivy-scans branch September 19, 2024 22:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@saisatishkarra saisatishkarra saisatishkarra approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@pankajmouriyakong @saisatishkarra