-
Notifications
You must be signed in to change notification settings - Fork 15
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Restore failing when CVE scanner finds a vulnerability #167
base: master
Are you sure you want to change the base?
Conversation
dc378e3
to
8176245
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we go back a step and explain:
A. the problem, B. Why this is the solution?
8176245
to
6357665
Compare
@rdohms Updated PR commit message and description |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
generally looks ok, but with the failing pipeline right now will be tricky to get this merged.
@agustingomes So it fails because it finds a CVE in the nginx 1.16 image for nginx ;) |
🤔 How will you be able to merge it in? |
That's the question! Can either fix that vurn in this PR, or fix it in a separate PR and then rebase |
During the migration to GitHub Actions in #160 this functionality was mistakenly and overzealously removed. Since PHP 8 and Alpine 3.13 are out and #166 has been filed, currently with a CVE for musl in it, this check should have failed as it is our goal to ship images without known CVE's in it. On my own PHP images the CVE checking fails and as such I was surprised that #166 didn't have any failures. Up on checking the CI logs it showed the musl CVE but the step didn't fail. This commit restores the original functionality and will make the CI once again fail when it finds a CVE in one of the images.
6357665
to
ac82b67
Compare
During the migration to GitHub Actions in #160 this functionality
was mistakenly and overzealously removed. Since PHP 8 and
Alpine 3.13 are out and #166 has been filed, currently with a CVE
for musl in it, this check should have failed as it is our goal
to ship images without known CVE's in it. On my own PHP images
the CVE checking fails and as such I was surprised that #166
didn't have any failures. Up on checking the CI logs it showed
the musl CVE but the step didn't fail.
This commit restores the original functionality and will make the
CI once again fail when it finds a CVE in one of the images.
Usabilla PHP Docker Template
Reviewers: @usabilla/oss-docker
Type
Please specify the type of changes being proposed: