[DNM] test: exercise Trivy scanning against images-shared#722 - #137
Draft
bschwedler wants to merge 4 commits into
Draft
[DNM] test: exercise Trivy scanning against images-shared#722#137bschwedler wants to merge 4 commits into
bschwedler wants to merge 4 commits into
Conversation
bschwedler
force-pushed
the
feat/trivy-security-scan
branch
2 times, most recently
from
August 10, 2026 16:53
38acec7 to
ceeab58
Compare
Prepares this repo to receive SARIF uploads from bakery-build-native.yml and bakery-build-pr.yml once images-shared#722/#729 land on main. The reusable workflows now upload results automatically — gated on push for native builds and unconditionally for PR builds — so no scan-image input is needed here. Part of the sequencing from images-shared#729: product repos grant the permission before the reusable workflow declares it, to avoid breaking callers still pinned to @main.
bschwedler
force-pushed
the
feat/trivy-security-scan
branch
from
August 10, 2026 19:50
ceeab58 to
d135fcf
Compare
These grants only exist to satisfy the SARIF code-scanning upload, which has moved out of images-shared#722 into images-shared#734. #722 no longer requests security-events on either reusable workflow, so nothing here needs them yet. The pr.yml pair would have stayed unused regardless: #734 wires the upload into bakery-build-native.yml only, since fork PRs get a read-only token and could not be granted the permission anyway. Leaves this branch as pure test wiring for #722's scanning, which needs no caller-side change -- the Scan step is ungated in the shared workflows. The native grants return in the follow-up that images-shared#729 sequences ahead of #734.
bschwedler
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test-only. Points package-manager's three build workflows at
images-shared'sfeat/trivy-security-scanso images-shared#722's Trivy scanning runs against real package-manager builds before it merges.Nothing here is mergeable — PR scanning needs no caller-side change, since the
Scanstep is ungated in the shared reusable workflows.security-events: writegrants were removed; they belong to the code-scanning upload in images-shared#734 and will land in a separate follow-up sequenced by images-shared#729.