Repository navigation
ci(security): add Trivy security scanning - #1
Merged
Merged
Conversation
- Scan pull requests, main updates, and daily schedules for security findings - Fail on high and critical vulnerabilities, secrets, and misconfigurations
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add the missing Trivy filesystem scan using the same workflow as the other golang-queue repositories. Scan vulnerabilities, secrets, and misconfigurations on pull requests to main, pushes to main, daily schedules, and manual dispatch. HIGH/CRITICAL findings fail the job; no exclusions or ignore rules are added.
AI authorship
.github/workflows/security.yml.Change classification and scope
Leaf: isolated CI configuration, no application behavior or public interfaces changed. One reviewer recommended. Goal: close the missing security-scan coverage. Related issues: N/A; none supplied.
Verification
Checkout
fix/trivy-security-scanata1339113b0033c5bf82109afc486e1e993a04c92and run from this repository root. Prerequisites: Trivy 0.69.3 with a current vulnerability database; Go 1.26.7 to run actionlint 1.7.12.trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH --exit-code 1 .go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/security.ymlgit diff --check main...HEADBehavioral scenario: this branch previously had no security workflow. Open the PR against
main, then inspect the Trivy Security Scan check; expect the scan job to complete successfully. Remote execution is pending at PR creation and will be checked separately. Daily/manual runs become available after merge. No runtime tests are applicable to this workflow-only change. Cleanup: none; tools only populate local caches.Security, risk, and rollback
Read-only contents permission; reviewed diff contains no secrets. The scan uses the existing organization HIGH/CRITICAL policy. Risk: future findings may block CI. Roll back by reverting this commit. Review the workflow triggers, scanner list, severity and nonzero exit policy.