refactor(ci): use dedicated trivy image scan workflow - #247
Draft
marcusburghardt wants to merge 1 commit into
Draft
refactor(ci): use dedicated trivy image scan workflow#247marcusburghardt wants to merge 1 commit into
marcusburghardt wants to merge 1 commit into
Conversation
Switch scan-image-beacon-distro from reusable_vuln_scan.yml to the new reusable_trivy_image_scan.yml which was extracted in org-infra to avoid forcing elevated permissions (packages: write, id-token: write) on callers that only need source/dependency scanning. Changes: - scan-source: remove packages:write, id-token:write, enable_trivy_image input (no longer needed after the trivy_image job was extracted) - scan-image-beacon-distro: switch to reusable_trivy_image_scan.yml, remove enable_osv/enable_trivy_source/enable_trivy_image inputs, trim permissions to only what the image scan needs Depends-on: complytime/org-infra#TBD Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switch the
scan-image-beacon-distrostage fromreusable_vuln_scan.ymlto the newreusable_trivy_image_scan.ymlwhich was extracted in org-infra to avoid forcingelevated permissions (
packages: write,id-token: write) on callers that onlyneed source/dependency scanning.
Changes to
ci_publish_ghcr.yml:packages: write,id-token: write, andenable_trivy_imageinput (no longer needed after the trivy_image job was extracted from the reusable workflow)reusable_trivy_image_scan.yml, removedenable_osv/enable_trivy_source/enable_trivy_imageinputs, trimmed permissions to only what the image scan job needsRelated Issues
Review Hints
This PR is a draft and must remain so until refactor(ci): extract trivy image scan into separate reusable workflow org-infra#290 is merged and tagged. The pinned SHA in the
uses:directives must be updated to the new release SHA before merging.The diff is small (3 insertions, 11 deletions). Review the permission trimming on
scan-sourceand the workflow switch onscan-image-beacon-distrotogether.The pipeline flow is unchanged:
scan-source -> build-beacon-distro -> scan-image-beacon-distro -> sign-beacon-distro -> summary. Only the reusable workflow reference and its inputs changed in stages 1 and 3.