Split published and example images vulnerability scanning #2914
Conversation
hairyhum
force-pushed
the
image-scanning-split
branch
3 times, most recently
from
b59a741
to
7a282cf
Compare
| @@ -0,0 +1,17 @@ | |||
| name: Published images vulnerability scanning | |||
There was a problem hiding this comment.
nit: Should the name for this workflow be different in order to more easily tell it apart when looking at all the (action) jobs.
Also, a shorter name would be nice.
There was a problem hiding this comment.
Yes. It's supposed to be different.
| EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) | ||
| echo "images_json<<$EOF" >> $GITHUB_OUTPUT | ||
| cat ${{ inputs.images_file }} >> $GITHUB_OUTPUT | ||
| echo "$EOF" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
What's this code doing actually? (Maybe a comment would be good)
Example images are images that we use in the examples. I don't have a better description for that honestly.
Maybe, but it's not clear how to address those. We can change the flag and see how many issues we get then. |
hairyhum
force-pushed
the
image-scanning-split
branch
from
a563e42
to
dec97ba
Compare
hairyhum
force-pushed
the
image-scanning-split
branch
from
dec97ba
to
8d94f5f
Compare
@psilva-veeam IOW: the objective is to facilitate or improve the identification of (vulnerability) notifications that are in the packaged (released "product") Kanister images in order to prioritize those first, over vulnerabilities that are only present in example images. |
|
@hairyhum @psilva-veeam Let's merge these changes as they are. We can iterate and address the comments as separate PRs. Thanks. |
|
I'm still enabling |
Change Overview
The idea behind this change is to separate critical and non-critical images scanning. So we can set up notifications when critical images have vulnerabilities.
This PR just separates the scanning workflow. #2829 will separate the image build workflow.
Future improvement: after #2829 is merged, we can trigger example image scanning on example images build workflow instead of main.
Pull request type
Please check the type of change your PR introduces:
Issues
Test Plan