artefactual-sdps / enduro

A tool to support ingest and automation in digital preservation workflows
https://enduro.readthedocs.io/
Apache License 2.0
4 stars 3 forks source link

Integrate Static Code Analysis Tools for IaC files #936

Closed sbreker closed 4 months ago

sbreker commented 4 months ago

This pull request enhances build security by integrating the Trivy static code analysis tool configured to scan IaC files.

This new GitHub action is currently configured to scan Dockerfiles only, but this will be expanded in future pull requests.

This PR also addresses a security enhancement identified by Trivy.

codecov[bot] commented 4 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 48.83%. Comparing base (db1a339) to head (063bd33). Report is 2 commits behind head on main.

:exclamation: Current head 063bd33 differs from pull request most recent head 0baa2b1. Consider uploading reports for the commit 0baa2b1 to get more accurate results

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #936 +/- ## ========================================== - Coverage 49.00% 48.83% -0.17% ========================================== Files 104 103 -1 Lines 5620 5533 -87 ========================================== - Hits 2754 2702 -52 + Misses 2616 2600 -16 + Partials 250 231 -19 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.