search

substrait-io / substrait-java

Apache License 2.0
72 stars 70 forks source link

build: add vulnerability scan to PR build #269

Closed bestbeforetoday closed 3 weeks ago

bestbeforetoday commented 3 weeks ago

Continue build on vulnerability detection.

Update protobuf dependency to address vulnerabilities:

github-advanced-security[bot] commented 3 weeks ago

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

bestbeforetoday commented 3 weeks ago

I had to back off from using the OSV-Scanner GitHub Action since multiple scan runs all appear to upload security analysis results with the same name. The current change just uses the osv-scanner CLI command directly and so will not populate the repository's Security tab.

vbarua commented 3 weeks ago

The current change just uses the osv-scanner CLI command directly and so will not populate the repository's Security tab.

How will we see the results of the scan? Are they added as comments to PRs?

bestbeforetoday commented 3 weeks ago

The scan jobs will fail if a vulnerability is detected and will show up as failed build checks against the PR. Unless they are required checks, it should not prevent changes being merged though.

An alternative might be to have a scheduled workflow that runs (perhaps daily) on the main branch content. It depends what you prefer.