rmoff commented on PR #15430:
URL: https://github.com/apache/iceberg/pull/15430#issuecomment-4253937027
OK, I think this PR is ready for folk to take another look please.
It uses the locked-down Trivy action (h/t @lhotari), which has been
allowlisted by ASF.
How it works:
- Builds distZip, unpacks it, and scans the JARs using rootfs mode
- Runs on JVM 21 only — dependency CVEs are JVM-independent, so one scan
is sufficient
- Flag, don't block: continue-on-error: true keeps the job green. The step
shows orange in the UI when CVEs are found.
- On push to main/release branches: uploads SARIF to the GitHub Security
tab
- On PRs: prints findings to the CI log (SARIF upload skipped — GitHub
only accepts results from default/protected branches)
- ignore-unfixed: true — only CVEs with available fixes are reported
Here are the execution paths, expected behaviours, and test evidence:
| # | Event | CVEs present? | Trivy step | SARIF upload | Job | Test run |
Test Result |
|---|-------|---------------|------------|--------------|-----|----------|--------|
| 1 | `pull_request` | No | Green (exit 0) | Skipped | Green | [apache
#24461065138](https://github.com/apache/iceberg/actions/runs/24461065138) |
PASS |
| 2 | `pull_request` | Yes | Orange (exit 1) | Skipped | Green | [apache
#24460397375](https://github.com/apache/iceberg/actions/runs/24460397375) |
PASS |
| 3 | `push` | No | Green (exit 0) | Uploads empty SARIF | Green | [fork
#24464476427](https://github.com/rmoff/iceberg/actions/runs/24464476427) | PASS
|
| 4 | `push` | Yes | Orange (exit 1) | Uploads SARIF | Green | [fork
#24460594945](https://github.com/rmoff/iceberg/actions/runs/24460594945) | PASS
|
N.B. To test "no CVEs present" condition, known CVEs were temporarily
suppressed via `.trivyignore`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
