Separate security scan options for PR and scheduled - Githubissues

coopnorge / github-workflow-supply-chain-security-validation

MIT License

0 stars 0 forks source link

Separate security scan options for PR and scheduled #88

Open pravindahal opened 3 months ago

pravindahal commented 3 months ago

For trivy scan:

the scan should fail if problematic code is being added in a PR
the scan should succeed and upload sarif artifact in case of scheduled scans

For this, two different ways of invoking trivy scan should be available and configurable.

As of https://github.com/coopnorge/github-workflow-supply-chain-security-validation/pull/87, only the latter is supported even though it is used in PRs everywhere.

AtzeDeVries commented 3 months ago

potentially related: https://github.com/coopnorge/github-workflow-supply-chain-security-validation/issues/90