ci: install trivy in bump-trivy workflow and update tests - #495
Merged
Merged
Conversation
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io>
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io>
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io>
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io>
nikpivkin
marked this pull request as ready for review
December 10, 2025 08:20
simar7
self-requested a review
December 11, 2025 05:29
simar7
approved these changes
Dec 11, 2025
jmendes-alto
added a commit
to AltoIRA/trivy-action
that referenced
this pull request
Mar 9, 2026
* ci: use setup-bats in bump-trivy workflow (aquasecurity#494) Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * chore: update README (aquasecurity#493) Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * ci: install trivy in bump-trivy workflow and update tests (aquasecurity#495) * ci: install trivy in bump-trivy workflow Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * test: diasble list-all-pkgs and remove ReportID Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * ci: run tests after updating golden files Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * fix BATS_LIB_PATH setting Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> --------- Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * chore(deps): Update trivy to v0.68.1 * ci: use checks bundle v2 in sync workflow (aquasecurity#505) * ci: use checks bundle v2 in sync workflow Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * test: update golden files Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> --------- Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * Merge commit from fork * chore(deps): Update trivy to v0.69.1 (aquasecurity#506) Co-authored-by: simar7 <simar7@users.noreply.github.com> * feat: support for YAML ignore file Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * ci(test): add zizmor security linter for GitHub Actions (aquasecurity#502) * ci: add zizmor security linter for GitHub Actions * ci: disable advanced-security for zizmor * ci: pin all actions to commit hashes * ci: fix zizmor linter errors in workflows - Add explicit permissions blocks to all workflows - Set persist-credentials: false for checkout actions - Fix template injection by using env variables in run blocks * fix: address zizmor template injection warnings in action.yaml - Move inputs to env block to prevent template injection - Add ignore comment for github-env false positive * ci: fix remaining zizmor linter errors - Add permissions and persist-credentials to test.yaml - Fix ignore comment placement for github-env in action.yaml * remove unused variable Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * add comment about fd3 Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * update trivyignores input description Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * supress progress bar when download db Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * remove unused init-cache target Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> * chore: bump default Trivy version to v0.69.2 (aquasecurity#513) * chore: bump Trivy version to v0.69.2 in test workflow and README (aquasecurity#515) * chore(deps): Update trivy to v0.69.3 (aquasecurity#519) Co-authored-by: nikpivkin <nikpivkin@users.noreply.github.com> --------- Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io> Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io> Co-authored-by: simar7 <simar7@users.noreply.github.com> Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com> Co-authored-by: Aqua Security automated builds <54269356+aqua-bot@users.noreply.github.com> Co-authored-by: Nicholas Jackson <nicholas@nuclearn.ai> Co-authored-by: nikpivkin <nikpivkin@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces several fixes and improvements to the testing workflow:
ReportIDfield, which is unique for each run (see feat: add ReportID field to scan reports trivy#9669).list-all-pkgsflag, which is now enabled by default (see feat(cli): change --list-all-pkgs default to true trivy#9510).The
ArtifactIDandFingerprintfields were left unchanged, as they are unique per artifact and do not affect test stability.Test run - https://github.com/nikpivkin/trivy-action/actions/runs/20091355885
Opened PR - nikpivkin#13