Skip to content

ci(security): add warn-only Trivy dependency CVE scan (orb 1.6.0) #766

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MarkusReadius wants to merge 9 commits into
base: master
Choose a base branch
from
Open

ci(security): add warn-only Trivy dependency CVE scan (orb 1.6.0) #766

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5a682ba
ci(security): add warn-only Trivy dependency CVE scan
MarkusReadius Jul 3, 2026
bd3b739
ci: trivy-scan orb 0.1.0 -> 0.1.1 (mirror.gcr.io DB chain, tag-pinned…
MarkusReadius Jul 3, 2026
7caa6df
Merge remote-tracking branch 'origin/master' into ci/trivy-cve-scanning
MarkusReadius Jul 23, 2026
e74e159
Bump trivy-scan orb to 1.0 (patch-float)
MarkusReadius Jul 23, 2026
e2cf7f0
Merge remote-tracking branch 'origin/master' into ci/trivy-cve-scanning
MarkusReadius Jul 28, 2026
f759a55
ci: run dependency-cve-scan in weekly_vulncheck as well
MarkusReadius Jul 28, 2026
b50c0a7
ci: pin trivy-scan to 1.1.2 and slack to 4.15.0
MarkusReadius Jul 30, 2026
028c5e1
Merge branch 'master' into ci/trivy-cve-scanning
MarkusReadius Jul 30, 2026
dc93e2a
ci: trivy-scan 1.6.0 (engine trivy v0.73.0)
MarkusReadius Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
version: 2.1
orbs:
slack: circleci/slack@4.1
slack: circleci/slack@4.15.0
trivy-scan: arangodb/trivy-scan@1.6.0
executors:
golang-executor:
docker:
Expand Down Expand Up @@ -389,6 +390,17 @@ jobs:
- run: make vulncheck
- *notify_slack_on_fail

dependency-cve-scan:
executor: golang-executor
steps:
- checkout
- trivy-scan/scan:
scan-type: fs
scan-path: "."
severity: "CRITICAL,HIGH"
fail-on-findings: false
store-junit-results: true

# GitHub release (tags VERSION bump, git push, github-release draft → publish).
# Requires CircleCI context: GITHUB_TOKEN or RELEASER_GITHUB_TOKEN (repo contents write). Optional: GIT_USER_NAME, GIT_USER_EMAIL.
# Pipeline parameter `publish` must be the exact Make target (see publish-release workflow regex).
Expand Down Expand Up @@ -456,6 +468,7 @@ workflows:
pattern: *publish_release_target_regex
jobs:
- check-code
- dependency-cve-scan
Comment thread
MarkusReadius marked this conversation as resolved.
- run-unit-tests:
requires:
- check-code
Expand Down Expand Up @@ -649,6 +662,7 @@ workflows:
- vulncheck:
context:
- slack
- dependency-cve-scan
triggers:
- schedule:
# 6:00 on every Monday
Expand Down