From 5a682ba08be00ab065a4c357a794d0357c826252 Mon Sep 17 00:00:00 2001 From: Mark Read Date: Fri, 3 Jul 2026 16:09:28 +0200 Subject: [PATCH 1/6] ci(security): add warn-only Trivy dependency CVE scan --- .circleci/config.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index a41298a4..8b46f3bb 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,6 +1,7 @@ version: 2.1 orbs: slack: circleci/slack@4.1 + trivy-scan: arangodb/trivy-scan@0.1.0 executors: golang-executor: docker: @@ -375,6 +376,17 @@ jobs: - run: make vulncheck - *notify_slack_on_fail + dependency-cve-scan: + executor: golang-executor + steps: + - checkout + - trivy-scan/scan: + scan-type: fs + scan-path: "." + severity: "CRITICAL,HIGH" + fail-on-findings: false + store-junit-results: true + # GitHub release (tags VERSION bump, git push, github-release draft → publish). # Requires CircleCI context: GITHUB_TOKEN or RELEASER_GITHUB_TOKEN (repo contents write). Optional: GIT_USER_NAME, GIT_USER_EMAIL. # Pipeline parameter `publish` must be the exact Make target (see publish-release workflow regex). @@ -442,6 +454,7 @@ workflows: pattern: *publish_release_target_regex jobs: - check-code + - dependency-cve-scan - run-unit-tests: requires: - check-code From bd3b739f56c53c44c29334ef8e71194a640ff801 Mon Sep 17 00:00:00 2001 From: Mark Read Date: Fri, 3 Jul 2026 16:22:24 +0200 Subject: [PATCH 2/6] ci: trivy-scan orb 0.1.0 -> 0.1.1 (mirror.gcr.io DB chain, tag-pinned install fallback; nightly EOL+comprehensive where applicable) --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 8b46f3bb..f8f28baa 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,7 +1,7 @@ version: 2.1 orbs: slack: circleci/slack@4.1 - trivy-scan: arangodb/trivy-scan@0.1.0 + trivy-scan: arangodb/trivy-scan@0.1.1 executors: golang-executor: docker: From e74e15908ac393ad4c8ae70f1f02feb3d32fd696 Mon Sep 17 00:00:00 2001 From: Mark Read Date: Wed, 22 Jul 2026 22:19:08 -0400 Subject: [PATCH 3/6] Bump trivy-scan orb to 1.0 (patch-float) --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 792e82da..dde2a803 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,7 +1,7 @@ version: 2.1 orbs: slack: circleci/slack@4.1 - trivy-scan: arangodb/trivy-scan@0.1.1 + trivy-scan: arangodb/trivy-scan@1.0 executors: golang-executor: docker: From f759a55db45c1c5f4e761146e7eb8590894f246d Mon Sep 17 00:00:00 2001 From: Mark Date: Tue, 28 Jul 2026 07:46:14 -0400 Subject: [PATCH 4/6] ci: run dependency-cve-scan in weekly_vulncheck as well Requested in review: the weekly master cron previously ran only the govulncheck job, so dependency CVE drift was invisible between PRs. --- .circleci/config.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index 501efbc9..b6cb1e36 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -662,6 +662,7 @@ workflows: - vulncheck: context: - slack + - dependency-cve-scan triggers: - schedule: # 6:00 on every Monday From b50c0a7dee9c8911453ef56322b7b27c20ebb422 Mon Sep 17 00:00:00 2001 From: Mark Date: Thu, 30 Jul 2026 00:00:01 -0400 Subject: [PATCH 5/6] ci: pin trivy-scan to 1.1.2 and slack to 4.15.0 Both were patch floats, which CircleCI resolves at config-compile time, so a new orb publish changes what runs with no repo diff. 4.15.0 is the newest 4.x, which is what the float resolves to today. --- .circleci/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index b6cb1e36..86a6a367 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,7 +1,7 @@ version: 2.1 orbs: - slack: circleci/slack@4.1 - trivy-scan: arangodb/trivy-scan@1.0 + slack: circleci/slack@4.15.0 + trivy-scan: arangodb/trivy-scan@1.1.2 executors: golang-executor: docker: From dc93e2a2cbc43d4411c0c54fec7647bcd3261b32 Mon Sep 17 00:00:00 2001 From: Mark Read <82614098+MarkusReadius@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:03:14 -0400 Subject: [PATCH 6/6] ci: trivy-scan 1.6.0 (engine trivy v0.73.0) --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 86a6a367..1465a667 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,7 +1,7 @@ version: 2.1 orbs: slack: circleci/slack@4.15.0 - trivy-scan: arangodb/trivy-scan@1.1.2 + trivy-scan: arangodb/trivy-scan@1.6.0 executors: golang-executor: docker: