Commit Graph

15 Commits

Author SHA1 Message Date
dependabot[bot]
1b7dd765a5 Bump aquasecurity/trivy-action from 0.28.0 to 0.29.0 (#11364)
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.28.0 to 0.29.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.28.0...0.29.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-26 10:15:46 -08:00
dependabot[bot]
ff23fb57a9 Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 (#11138)
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.27.0 to 0.28.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.27.0...0.28.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-21 09:35:16 -07:00
dependabot[bot]
14eee80f69 Bump aquasecurity/trivy-action from 0.24.0 to 0.27.0 (#11105)
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.24.0 to 0.27.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.24.0...0.27.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-16 12:22:17 -07:00
Derek Nola
ab89363e18 Fix trivy vex line (#10970)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-10-01 15:06:49 -07:00
Guilherme Macedo
0553a1a1d9 Pass Rancher's VEX report to Trivy to remove known false-positives CVEs (#10956)
Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
2024-10-01 17:20:35 -04:00
Derek Nola
2739f50d77 Trivy workflow: Checkout repo to use gh cli (#10949)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-09-25 13:20:26 -07:00
Derek Nola
97e8486032 Fix trivy report download (#10943)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-09-25 10:09:09 -07:00
Derek Nola
3a268acb78 Check k3s-io organization membership not team membership for trivy scans (#10940)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-09-24 14:37:32 -07:00
Derek Nola
6731f4a70d Fix getMembershipForUserInOrg call (#10937)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-09-24 13:06:27 -07:00
Derek Nola
005711fad6 Breakup trivy scan and check comment author (#10935)
* Check comment author on trivy scan
* Breakup trivy workflow for better permission security

Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-09-24 12:10:31 -07:00
Derek Nola
61c7011cab Give good report if no CVEs found in trivy (#10853)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-09-06 14:58:26 -07:00
Brad Davidson
378edb939d Tag PR image build as latest before scanning
This is less effort than passing the tag across steps 🤷‍♂️

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-09-05 15:21:56 -07:00
Brad Davidson
3d6e4a793a Fix /trivy action running against target branch instead of PR branch
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-09-04 15:57:39 -07:00
dependabot[bot]
dacc636cf4 Bump aquasecurity/trivy-action from 0.20.0 to 0.24.0 (#10795)
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.20.0 to 0.24.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.20.0...0.24.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-03 09:14:54 -07:00
Derek Nola
fa6940d03d Add trivy scanning trigger for PRs (#10758)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-08-30 09:00:50 -07:00