From 51c255ac152d6b526c0902487b62d0960a4345d8 Mon Sep 17 00:00:00 2001 From: Gian Miguel Del Mundo Date: Thu, 25 Apr 2024 15:28:33 +0800 Subject: [PATCH 1/2] Added build-and-test pipeline for vuln scanning --- .github/workflows/build-and-test.yaml | 10 ++++++++++ .trivyignore | 5 +++++ 2 files changed, 15 insertions(+) create mode 100644 .github/workflows/build-and-test.yaml create mode 100644 .trivyignore diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml new file mode 100644 index 0000000..f6faae8 --- /dev/null +++ b/.github/workflows/build-and-test.yaml @@ -0,0 +1,10 @@ +name: Build and Test +on: [pull_request, push, workflow_dispatch] + +jobs: + build: + uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-build-and-test.yaml@v2 + secrets: inherit + with: + vulnerability_scan_only: true + publish_vulnerabilities: false diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 0000000..6ac5cb7 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,5 @@ +# List any vulnerability that are to be accepted +# See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/ +# for more details +# e.g. +# CVE-2022-3996 From c05f2df52c532a561901f248998b185f62efd901 Mon Sep 17 00:00:00 2001 From: Gian Miguel Del Mundo Date: Thu, 25 Apr 2024 17:55:40 +0800 Subject: [PATCH 2/2] Enabled publish vulnerabilities --- .github/workflows/build-and-test.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml index f6faae8..6e5d811 100644 --- a/.github/workflows/build-and-test.yaml +++ b/.github/workflows/build-and-test.yaml @@ -7,4 +7,3 @@ jobs: secrets: inherit with: vulnerability_scan_only: true - publish_vulnerabilities: false