search

canonical / oci-factory

The CI/CD for shared container registry namespaces
9 stars 23 forks source link

Issue for distinct revisions when vulnerabilities are found #295

Closed zhijie-yang closed 1 week ago

zhijie-yang commented 1 week ago

Ping the @canonical/rocks team.

Description

  1. GitHub issues will be created w.r.t. each revision of an image that contains CVEs found in the vulnerability scanning workflows triggered with continuous testing workflow. In the report, all the affected tags associated with the revision will be included in the report.
  2. When vulnerabilities are found for the images tested in the Image workflow triggered by a push, a pull request or a workflow dispatch event, the vulnerability report will be dumped to a summary instead of creating an issue at the image repo.
  3. This shall fix the issue that an issue will be accidentally closed when the different risks in a track of an image are tagged to different revisions, and only some of the revisions have found CVEs.

Tests