You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
bakery trivy scan (#218, #722) now writes SARIF per target to results/trivy/, but doesn't upload it to GitHub code scanning. Adding security-events: write to bakery-build-native.yml's build-test job during #722's review would have hard-failed every existing caller (this repo's own ci.yml, plus images-connect/images-workbench/images-package-manager, all pinned to @main) on their next run — GitHub validates a reusable workflow's requested job permissions against the caller's grant before the job runs, independent of any step-level if: gate.
The images-shared side is now implemented and waiting in #734, which is stacked on #722. It must not merge until the product-repo grants land.
Filenames and categories are now separate.results/trivy/<image>/<uid>.sarif is unique per target; the version-stable category rides in each run's automationDetails.id. upload-sarif only fills automationDetails in when it is absent, so a single directory upload carries a distinct category per file. Deriving the filename from the category (as feat: add bakery trivy scan plugin and CI wiring #722 originally did) collapsed 50 images-connect targets onto 6 files, silently overwriting 44 versions' results.
Scope is native builds only.feat: add bakery trivy scan plugin and CI wiring #722 now gates scanning on push && latest, so code scanning only ever sees published, latest-version images. PR-build scanning moved to feat: add opt-in Trivy scanning to PR builds #741 as an opt-in input and is deliberately not wired to code scanning: fork PRs get a read-only token and cannot be granted security-events: write, and PR-time uploads of non-latest versions would have no baseline on main to diff against.
bakery trivy scan (#218, #722) now writes SARIF per target to results/trivy/, but doesn't upload it to GitHub code scanning. Adding security-events: write to bakery-build-native.yml's build-test job during #722's review would have hard-failed every existing caller (this repo's own ci.yml, plus images-connect/images-workbench/images-package-manager, all pinned to @main) on their next run — GitHub validates a reusable workflow's requested job permissions against the caller's grant before the job runs, independent of any step-level if: gate.
The images-shared side is now implemented and waiting in #734, which is stacked on #722. It must not merge until the product-repo grants land.
Notes from implementing #734
results/trivy/<image>/<uid>.sarifis unique per target; the version-stable category rides in each run'sautomationDetails.id.upload-sarifonly fillsautomationDetailsin when it is absent, so a single directory upload carries a distinct category per file. Deriving the filename from the category (as feat: add bakery trivy scan plugin and CI wiring #722 originally did) collapsed 50 images-connect targets onto 6 files, silently overwriting 44 versions' results.push && latest, so code scanning only ever sees published, latest-version images. PR-build scanning moved to feat: add opt-in Trivy scanning to PR builds #741 as an opt-in input and is deliberately not wired to code scanning: fork PRs get a read-only token and cannot be granted security-events: write, and PR-time uploads of non-latest versions would have no baseline on main to diff against.Related