Open nicksantamaria opened 1 year ago
@GROwen has suggested we could do a trivy scan of the SBOM generated by lagoon, and then push the resulting sarif file to the github security tool. This would give us some consistency in terms of tooling used for monitoring vulnerabilities.
Leverage bill of materials that lagoon generates.
Run in AWX?
Surface results in a report.