Fix cve scan workflow - Githubissues

vmware-tanzu / tanzu-framework

Tanzu Framework provides a set of building blocks to build atop of the Tanzu platform and leverages Carvel packaging and plugins to provide users with a much stronger, more integrated experience than the loose coupling and stand-alone commands of the previous generation of tools.

Apache License 2.0

195 stars 192 forks source link

What this PR does / why we need it

The github action for trivy was configured to use a config file .trivy.yaml for its execution. The latest release of the github action when used with config file, generates an empty sarif file which leads to error in the upload reports step. A workaround for this issue is to pass the required config as arguments directly to the github action. The only exception here being the debug flag which is not supported as an argument in the action.

Which issue(s) this PR fixes

Fixes #4632

Describe testing done for PR

CVE scan passes successfully for this PR.

Release note

Additional information

Special notes for your reviewer

Codecov Report

Merging #4631 (bd90723) into main (bb07e03) will increase coverage by 24.94%. The diff coverage is n/a.

@@ Coverage Diff @@ ## main #4631 +/- ## =========================================== + Coverage 49.77% 74.72% +24.94% =========================================== Files 453 21 -432 Lines 45424 1199 -44225 =========================================== - Hits 22612 896 -21716 + Misses 20652 252 -20400 + Partials 2160 51 -2109