search

iver-wharf / iver-wharf.github.io

Documentation of Wharf
https://iver-wharf.github.io
MIT License
2 stars 0 forks source link

Add Trivy vulnerability scans to all docker-released repos #72

Closed applejag closed 2 years ago

applejag commented 3 years ago

Best case:

  1. Once a day, a GitHub Action builds the docker image and scans it
  2. If there are vulnerabilities, an issue is created with the label security
    • How to handle if issue already exists? Create yet another one? Update the existing one? Do nothing while such a vulnerability scan issue already exists?

The issues should contain description of how to build and scan the docker image yourself locally. Such as:

$ docker build . -t wharf-web

$ docker save wharf-web -o image.tar

$ trivy image --input image.tar

There are some alternatives available, just searching the internet for "trivy github action" yields lots of good alternatives.

Suggest to add this to one repo, and once that is reviewed and merged, first then start applying it to the rest of the repos.

Repos that need this:

In the future we can translate this to a Wharf build, but as Wharf lacks this kind of integration right now we should start the work using GitHub Actions.

applejag commented 2 years ago

This is done.