search

chainguard-dev / rumble

Data collection for base image CVEs etc.
Apache License 2.0
3 stars 8 forks source link

Switch rumble to scan based on our API. #75

Closed mattmoor closed 1 year ago

mattmoor commented 1 year ago

You can see a sample of me experimenting with this matrix logic here: https://github.com/chainguard-dev/mattmoor-actions/actions/runs/5232285997

Right now this limits to :latest, which is only about half of the images we scan today, but if it's important then we could add a :latest-dev shard to the mix pretty easily by adding another output with latest-dev in the JQ.

mattmoor commented 1 year ago

The last sync run scanned 298 images based on the old matrix and my dry run of this lists about 170.

I think the (potentially) major remaining chunk we might care about here is latest-dev, but since we are going to be dropping non-latest tags I think these two are the main ones we care about 🤔

jspeed-meyers commented 1 year ago

Right now this limits to :latest, which is only about half of the images we scan today, but if it's important then we could add a :latest-dev shard to the mix pretty easily by adding another output with latest-dev in the JQ.

:latest is what I care about for Labs and DevRel purposes. I defer to you and @jdolitsky whether more than that is needed! Thank you!

mattmoor commented 1 year ago

Ok, let's switch to this and we can expand to include other tags via the API as we find uncovered stuff we care about.