search

substrait-io / substrait-java

Apache License 2.0
77 stars 72 forks source link

build: add vulnerability scan to PR build #269

Closed bestbeforetoday closed 5 months ago

bestbeforetoday commented 5 months ago

Continue build on vulnerability detection.

Update protobuf dependency to address vulnerabilities:

github-advanced-security[bot] commented 5 months ago

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

bestbeforetoday commented 5 months ago

I had to back off from using the OSV-Scanner GitHub Action since multiple scan runs all appear to upload security analysis results with the same name. The current change just uses the osv-scanner CLI command directly and so will not populate the repository's Security tab.

vbarua commented 5 months ago

The current change just uses the osv-scanner CLI command directly and so will not populate the repository's Security tab.

How will we see the results of the scan? Are they added as comments to PRs?

bestbeforetoday commented 5 months ago

The scan jobs will fail if a vulnerability is detected and will show up as failed build checks against the PR. Unless they are required checks, it should not prevent changes being merged though.

An alternative might be to have a scheduled workflow that runs (perhaps daily) on the main branch content. It depends what you prefer.