ci: upload scan results to security agent #681
Conversation
| - name: Run Trivy vulnerability scan | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: "ddn-workspace:test" | ||
| format: "sarif" | ||
| output: "trivy-results.sarif" | ||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| if: always() | ||
| with: | ||
| sarif_file: "trivy-results.sarif" | ||
|
|
||
| - name: Print Trivy vulnerability scan results | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: "ddn-workspace:test" | ||
| format: "table" | ||
| exit-code: 0 | ||
| ignore-unfixed: true | ||
| vuln-type: "os,library" | ||
| severity: "CRITICAL,HIGH" | ||
|
|
||
|
|
There was a problem hiding this comment.
@codingkarthik I have two questions for you:
- Running the scan in the
build-ddn-workspaceleads to a "no space left on disk" error like this. Was it the reason we chose to run the trivy scan as part oftest-connectorsjob? - Right now
test-connectorsjob is failing like this - it might be valid test failure or a flake (I will let you determine). But do you think it is okay to run this CI job on all PRs and in the main branch to keep the tests passing always?
There was a problem hiding this comment.
Running the scan in the build-ddn-workspace leads to a "no space left on disk" error like this. Was it the reason we chose to run the trivy scan as part of test-connectors job?
No, I just wanted the testing bit to be separate from the building ddn workspace bit. I have never seen the no space left on disk error.
Right now test-connectors job is failing like this - it might be valid test failure or a flake (I will let you determine). But do you think it is okay to run this CI job on all PRs and in the main branch to keep the tests passing always?
I think this is a bug in the DDN workspace testing framework, the test is now picking up the wrong version of the connector. I will fix this in this PR itself.
There was a problem hiding this comment.
I added a patch to revert to run the scan after the tests. I think tests are still failing - could you check once?
…en matrix is empty
This reverts commit c31a99c.
codingkarthik
had a problem deploying
to
staging
GitHub Actions
Failure
3 participants
This PR does the following: