ci: add workflow to check for vulnerabilities in images #381
Conversation
rkpattnaik780
force-pushed
the
main
branch
2 times, most recently
from
467aca4
to
38d3b0d
Compare
rkpattnaik780
changed the title
rkpattnaik780
force-pushed
the
main
branch
2 times, most recently
from
4dfa800
to
4efc18f
Compare
|
Tnx /lgtm 🙂 |
|
I have one (additional) suggestion. Enable Dependabot security alerts for this repo. Currently, GitHub (dependabot) is already scanning dependencies in this repository and lists them on https://github.com/opendatahub-io/notebooks/network/dependencies. What it does not do is show the vulnerablities tab, which must be enabled extra https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts#configuration-of-dependabot-alerts |
| * `ci/security-scan/weekly_commit_ids` with the latest updated SHA digests of the notebooks (N & N-1) | ||
| Created by `/.github/workflows/sec-scan.yaml` | ||
|
|
||
| :exclamation: **IMPORTANT NOTE**: Remember to delete the ` ${{ env.SEC_SCAN_BRANCH }}` branch after merging the changes |
There was a problem hiding this comment.
Consider enabling https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches in repository settings. Autodeleted branches can be restored with push of a button if still needed later.
There was a problem hiding this comment.
Thanks for the suggestion. We can club it with automating deletion for this workflow as well.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: harshad16 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Add automation to generate a weekly report of security vulnerabilities found by Quay.
Description
A workflow has been added to display the vulnerabilities found in the different workbench images in tabular format.
How Has This Been Tested?
A dry run in fork will result the following changes. link
Merge criteria: