RHOAIENG-9473: Optionally enable Trivy for pull requests

caponetto commented 6 days ago

https://issues.redhat.com/browse/RHOAIENG-9473

Description

This PR enables Trivy scan for PRs. It won't run by default for all PRs because it adds extra minutes to the jobs and the report won't be needed for all PRs. In order to execute the scan, the label trivy-scan must be added to the PR before its creation. The workflow does not react to label changes, so a new commit must be pushed to run the scan if the trivy-scan label is added after the PR is opened.

Also on this PR:

The --severity option includes all of them when the trigger is PR, while the daily report only includes HIGH and CRITICAL ones. This is because low and medium issues are numerous and could be more interesting to be listed in a PR, rather than the daily report.
Added the --ignore-unfixed option to reduce the size of the report table. An issue that does not have a fixed version is not very useful to be listed.
Added concurrency for the PR workflow that builds notebooks to reduce redundant builds.
Removed scan for secrets as it takes more time and it's not bringing value to the reports.
For reviewers: I didn't touch the pull_request: make ${{ inputs.target }} step; I only moved it up.

How Has This Been Tested?

I've executed the tests on my fork.

Merge criteria:

[x] The commits are squashed in a cohesive manner and have meaningful messages.
[x] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
[x] The developer has manually tested the changes and verified that the changes work

jiridanek commented 2 days ago

@atheo89 can you please create a trivy-scan label in this project, and give it some nice color?

openshift-ci[bot] commented 2 days ago

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: jiridanek, jstourac

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/opendatahub-io/notebooks/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

opendatahub-io / notebooks