Codecov Report

Merging #3727 (21ef801) into main (102f811) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #3727   +/-   ##
=======================================
  Coverage   61.55%   61.55%           
=======================================
  Files          35       35           
  Lines        1813     1813           
  Branches      365      365           
=======================================
  Hits         1116     1116           
  Misses        588      588           
  Partials      109      109           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 102f811...21ef801. Read the comment docs.

Weird, I swear it worked before but now I'm getting this error. Thinking out loud here...

1. We build docker images and then upload them as artifacts under release-images
2. In trivy-scan-image, we download those release images
3. Then we run the Trivy vulnerability scanner and pass in the .tar file as input 🤔 Is this the correct thing to do? Looking under inputs in the docs, yes, .tar is expected.
4. Looks like it wants a manifest.json in the Docker image, which we may or may not have...
5. And it also wants index.json I think? hmm

@oxy any ideas?

@jsjoeio You could also push the image to GitHub's container registry and then pull/scan from there, but we'd have to prune old images or else the cost will add up

Hmm...I've never used GitHub's container registry. (I would be worried that someone forgets to prune or something breaks with that flow and we get charged a lot 😂)

I'm open to it though! Would you recommend that instead?

Possibly related: aquasecurity/trivy#1080

GitHub's container registry

I looked into this and pushing is easy.

I found this action for deleting by tag

We could probably combine the three:

1. Push to GitHub container registry
2. Use with trivy-scan-image
3. Delete from GitHub container registry

We also need to make sure the repo has access to the container packages.

After thinking about this a bit more, I've decided to put this on hold. It would take some time to set everything up for the GitHub Container Registry. I'd rather wait to see if we get a response on aquasecurity/trivy#1080 before taking on the work to make this happen.