[CI] Add Trivy workflow #16840
[CI] Add Trivy workflow #16840
Conversation
This patch adds a workflow to perform trivy check as required by our public release policy.
KornevNikita
had a problem deploying
to
WindowsCILock
GitHub Actions
Failure
KornevNikita
had a problem deploying
to
WindowsCILock
GitHub Actions
Failure
KornevNikita
temporarily deployed
to
WindowsCILock
GitHub Actions
Inactive
KornevNikita
temporarily deployed
to
WindowsCILock
GitHub Actions
Inactive
|
@intel/dpcpp-devops-reviewers (especially @uditagarwal97 @sarnex) could you please take one more look and also check this discussion please? |
| on: | ||
| pull_request: | ||
| paths: | ||
| - 'devops/containers/**' |
There was a problem hiding this comment.
@aelovikov-intel might have an opinon here :P
There was a problem hiding this comment.
I think we should add the files from this PR too.
There was a problem hiding this comment.
@aelovikov-intel could you please clarify what do you mean? Just trigger on every PR?
There was a problem hiding this comment.
Changes to this workflow and this trivy configuration should trigger CI.
There was a problem hiding this comment.
Thanks, got it 28a701e
| with: | ||
| name: trivy-report | ||
| path: trivy-report.json | ||
| retention-days: 3 |
There was a problem hiding this comment.
Since this check takes like ~10s, I think 3 days is even too much :) you can just re-run it if needed. Anyway, what it should be in your opinion?
There was a problem hiding this comment.
i guess it depends on how do we expect the results to be used? is it just checking it when the workflow fails and not really after that? if so this is fine
There was a problem hiding this comment.
i guess it depends on how do we expect the results to be used? is it just checking it when the workflow fails and not really after that? if so this is fine
The main use case is to upload them as an evidence of the scan.
@KornevNikita, is it correct to assume that any new issue will fail this workflow? If so, then 3 days is more than enough to grab results which are expected to be always good.
There was a problem hiding this comment.
It's good that Nick asked, turned out we need to set "exit-code" arg to get a non-zero result in case of fail - updated 0fdba39
There was a problem hiding this comment.
I bet he found it out a day or two ago when hunting zombies :D
Co-authored-by: Nick Sarnie <[email protected]>
KornevNikita
temporarily deployed
to
WindowsCILock
GitHub Actions
Inactive
KornevNikita
had a problem deploying
to
WindowsCILock
GitHub Actions
Error
KornevNikita
temporarily deployed
to
WindowsCILock
GitHub Actions
Inactive
|
@intel/dpcpp-devops-reviewers thanks for the feedback, could you please merge? I guess there is no need to wait for the pre-commit |
KornevNikita
temporarily deployed
to
WindowsCILock
GitHub Actions
Inactive
This patch adds a workflow to perform trivy check as required by our public release policy.