Skip to content

Commit 32b5f20

Browse files
DmitriyLewenDmitriyLewen
committed
Merge branch 'main' into 'feat/add-seal-vendor-for-detectors'
2 parents 62358ae + 99eabdf commit 32b5f20

66 files changed

Lines changed: 1144 additions & 927 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Global
2-
* @knqyf263
2+
* @knqyf263 @DmitriyLewen
33

44
# SBOM/Vulnerability scanning
55
pkg/dependency/ @knqyf263 @DmitriyLewen
@@ -8,15 +8,15 @@ pkg/sbom/ @knqyf263 @DmitriyLewen
88
pkg/scanner/ @knqyf263 @DmitriyLewen
99

1010
# Misconfiguration scanning
11-
docs/guide/scanner/misconfiguration/ @simar7 @nikpivkin
12-
docs/guide/target/aws.md @simar7 @nikpivkin
13-
pkg/fanal/analyzer/config/ @simar7 @nikpivkin
14-
pkg/config/aws/ @simar7 @nikpivkin
15-
pkg/iac/ @simar7 @nikpivkin
11+
docs/guide/scanner/misconfiguration/ @nikpivkin
12+
docs/guide/target/aws.md @nikpivkin
13+
pkg/fanal/analyzer/config/ @nikpivkin
14+
pkg/config/aws/ @nikpivkin
15+
pkg/iac/ @nikpivkin
1616

1717
# Helm chart
18-
helm/trivy/ @afdesk @simar7
18+
helm/trivy/ @afdesk
1919

2020
# Kubernetes scanning
21-
pkg/k8s/ @afdesk @simar7
22-
docs/guide/target/kubernetes.md @afdesk @simar7
21+
pkg/k8s/ @afdesk
22+
docs/guide/target/kubernetes.md @afdesk

‎.github/actions/setup-go/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ runs:
2626
echo "version=$major_minor" >> "$GITHUB_OUTPUT"
2727
2828
- name: Set up Go
29-
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
29+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3030
with:
3131
go-version: ${{ steps.go-version.outputs.version }}
3232
cache: false

‎.github/workflows/auto-close-issue.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66

77
jobs:
88
close_issue:
9-
runs-on: ubuntu-latest
9+
runs-on: ubuntu-2404-2core
1010
steps:
1111
- name: Close issue if user does not have write or admin permissions
1212
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0

‎.github/workflows/auto-ready-for-review.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ on:
1010

1111
jobs:
1212
auto-ready-for-review:
13-
runs-on: ubuntu-24.04
13+
runs-on: ubuntu-2404-2core
1414
if: github.event.workflow_run.event == 'pull_request'
1515
steps:
1616
- name: Get PR context

‎.github/workflows/auto-update-labels.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
jobs:
99
deploy:
1010
name: Auto-update labels
11-
runs-on: ubuntu-latest
11+
runs-on: ubuntu-2404-2core
1212
steps:
1313
- name: Checkout main
1414
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/backport.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
jobs:
88
check_permission:
99
name: Check comment author permissions
10-
runs-on: ubuntu-latest
10+
runs-on: ubuntu-2404-2core
1111
outputs:
1212
is_maintainer: ${{ steps.check_permission.outputs.is_maintainer }}
1313
steps:
@@ -32,8 +32,7 @@ jobs:
3232
github.event.issue.pull_request &&
3333
github.event.issue.pull_request.merged_at != null &&
3434
startsWith(github.event.comment.body, '@aqua-bot backport release/')
35-
runs-on: ubuntu-latest
36-
35+
runs-on: ubuntu-2404-2core
3736
steps:
3837
- name: Checkout repository
3938
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -59,8 +58,8 @@ jobs:
5958
6059
- name: Run backport script
6160
env:
62-
# Use ORG_REPO_TOKEN instead of GITHUB_TOKEN
61+
# Use TRIVY_REPO_TOKEN instead of GITHUB_TOKEN
6362
# This allows the created PR to trigger tests and other workflows
64-
GITHUB_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
63+
GITHUB_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
6564
ISSUE_NUMBER: ${{ github.event.issue.number }}
6665
run: ./misc/backport/backport.sh "$BRANCH_NAME" "$ISSUE_NUMBER"

‎.github/workflows/cache-test-assets.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
echo "digest=$DIGEST" >> $GITHUB_OUTPUT
3535
3636
- name: Restore and save test images cache
37-
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
37+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
3838
with:
3939
path: integration/testdata/fixtures/images
4040
key: cache-test-images-${{ steps.image-digest.outputs.digest }}
@@ -66,7 +66,7 @@ jobs:
6666
echo "digest=$DIGEST" >> $GITHUB_OUTPUT
6767
6868
- name: Restore and save test VM images cache
69-
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
69+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
7070
with:
7171
path: integration/testdata/fixtures/vm-images
7272
key: cache-test-vm-images-${{ steps.image-digest.outputs.digest }}

‎.github/workflows/canary.yaml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,44 +23,46 @@ jobs:
2323
ECR_ACCESS_KEY_ID: ${{ secrets.ECR_ACCESS_KEY_ID }}
2424
ECR_SECRET_ACCESS_KEY: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
2525
GPG_KEY: ${{ secrets.GPG_KEY }}
26-
ORG_REPO_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
26+
TRIVY_REPO_TOKEN: ${{ secrets.TRIVY_REPO_TOKEN }}
2727
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
2828

2929
upload-binaries:
3030
name: Upload binaries
3131
needs: build-binaries # run this job after 'build-binaries' job completes
32-
runs-on: ubuntu-latest
32+
runs-on: ubuntu-2404-2core
33+
permissions:
34+
actions: write # Required to delete caches
3335
steps:
3436
- name: Restore Trivy binaries from cache
35-
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
37+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
3638
with:
3739
path: dist/
3840
key: ${{ runner.os }}-bins-${{ github.workflow }}-${{ github.sha }}
3941

4042
# Upload artifacts
4143
- name: Upload artifacts (trivy_Linux-64bit)
42-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
44+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
4345
with:
4446
name: trivy_Linux-64bit
4547
path: dist/trivy_*_Linux-64bit.tar.gz
4648
if-no-files-found: error
4749

4850
- name: Upload artifacts (trivy_Linux-ARM64)
49-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
51+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
5052
with:
5153
name: trivy_Linux-ARM64
5254
path: dist/trivy_*_Linux-ARM64.tar.gz
5355
if-no-files-found: error
5456

5557
- name: Upload artifacts (trivy_macOS-64bit)
56-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
58+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
5759
with:
5860
name: trivy_macOS-64bit
5961
path: dist/trivy_*_macOS-64bit.tar.gz
6062
if-no-files-found: error
6163

6264
- name: Upload artifacts (trivy_macOS-ARM64)
63-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
65+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
6466
with:
6567
name: trivy_macOS-ARM64
6668
path: dist/trivy_*_macOS-ARM64.tar.gz

‎.github/workflows/mkdocs-dev.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ on:
99
jobs:
1010
deploy:
1111
name: Deploy the dev documentation
12-
runs-on: ubuntu-22.04
12+
runs-on: ubuntu-2404-2core
1313
steps:
1414
- name: Checkout main
1515
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -22,10 +22,7 @@ jobs:
2222
- name: Install dependencies
2323
run: |
2424
python -m pip install --upgrade pip setuptools wheel
25-
pip install git+https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git@9.5.44-insiders-4.53.14
2625
pip install -r docs/build/requirements.txt
27-
env:
28-
GH_TOKEN: ${{ secrets.MKDOCS_AQUA_BOT }}
2926
- name: Configure the git user
3027
run: |
3128
git config user.name "github-actions[bot]"

‎.github/workflows/mkdocs-latest.yaml‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ on:
1111
jobs:
1212
deploy:
1313
name: Deploy the latest documentation
14-
runs-on: ubuntu-22.04
14+
runs-on: ubuntu-2404-2core
1515
steps:
1616
- name: Checkout main
1717
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -24,10 +24,7 @@ jobs:
2424
- name: Install dependencies
2525
run: |
2626
python -m pip install --upgrade pip setuptools wheel
27-
pip install git+https://${GH_TOKEN}@github.com/squidfunk/mkdocs-material-insiders.git@9.5.44-insiders-4.53.14
2827
pip install -r docs/build/requirements.txt
29-
env:
30-
GH_TOKEN: ${{ secrets.MKDOCS_AQUA_BOT }}
3128
- name: Configure the git user
3229
run: |
3330
git config user.name "github-actions[bot]"
@@ -46,13 +43,13 @@ jobs:
4643
# This workflow is used to trigger the trivy-www deployment
4744
trigger-trivy-www-deploy:
4845
needs: deploy
49-
runs-on: ubuntu-22.04
46+
runs-on: ubuntu-2404-2core
5047
steps:
5148
- name: Trigger update_version workflow in trivy-telemetry
5249
env:
53-
# Use ORG_REPO_TOKEN instead of GITHUB_TOKEN
50+
# Use TRIVY_WORKFLOW_TRIGGER_TOKEN instead of GITHUB_TOKEN
5451
# This allows triggering workflows in other repositories
55-
GH_TOKEN: ${{ secrets.ORG_REPO_TOKEN }}
52+
GH_TOKEN: ${{ secrets.TRIVY_WORKFLOW_TRIGGER_TOKEN }}
5653
run: |
5754
gh workflow run build-docs.yml \
5855
--repo "$GITHUB_REPOSITORY_OWNER/trivy-www" \

0 commit comments

Comments
 (0)