ci(security): add warn-only Trivy dependency CVE scan (orb 1.6.0) - #766
Open
MarkusReadius wants to merge 9 commits into
Open
ci(security): add warn-only Trivy dependency CVE scan (orb 1.6.0)#766MarkusReadius wants to merge 9 commits into
MarkusReadius wants to merge 9 commits into
Conversation
MarkusReadius
requested review from
ajanikow,
bluepal-prasanthi-moparthi and
jwierzbo
as code owners
July 3, 2026 14:09
… install fallback; nightly EOL+comprehensive where applicable)
jwierzbo
reviewed
Jul 3, 2026
MarkusReadius
changed the title
Requested in review: the weekly master cron previously ran only the govulncheck job, so dependency CVE drift was invisible between PRs.
Both were patch floats, which CircleCI resolves at config-compile time, so a new orb publish changes what runs with no repo diff. 4.15.0 is the newest 4.x, which is what the float resolves to today.
MarkusReadius
changed the title
MarkusReadius
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
dependency-cve-scan, wired intorun_tests(every PR and every non-publish push to master) andweekly_vulncheck(Monday 06:00 cron on master, alongsidemake vulncheck). Trivy filesystem scan over the checkout, reporting fixable CRITICAL/HIGH. The scan path is the repo root, so the root,v2andv3modules are all covered.fail-on-findings: false. Results land in the job log, the artifacts and the CircleCI Tests tab.arangodb/trivy-scan@1.1.2is new; the pre-existingcircleci/slack@4.1float becomes4.15.0, which is a minor bump as well as a pin since@4.1resolves to 4.1.4 today. Bothslack/notifycall sites pass onlychannel,eventandtemplate, all still supported in 4.15.0.Only
.circleci/config.ymlchanges. No application code and no dependency versions are touched.Why
A float resolves at config-compile time, so an orb publish changes what runs with no repo diff and no review.
The scan is warn-only because this is a client library: a fixable CVE in a transitive dependency should not block driver PRs, and consumers pin their own module versions. This buys visibility first. Making it an enforcing gate is a separate call for the team.
Notes
scannersis left at the orb default, so the job runs Trivy's default fs scanners, dependency CVEs plus secret detection. Both are warn-only here. Setscanners: vulnif this should be dependency-only.circleci_orbs/trivy-scanin arangoml/ai-infrastructure#69, still open.dependency-cve-scanincluded.