From 6fa41dd3eebc181a4d1591ae164925a83c2014fd Mon Sep 17 00:00:00 2001 From: David Blane Date: Tue, 14 Jul 2026 17:03:07 +0100 Subject: [PATCH 1/3] Enable Trivy container CVE scan in build-docker (ENG-314) Sets scan_container: true on the build-docker call(s) so the built amd64 image is scanned with Trivy and the build fails on CRITICAL findings. ENG-314 --- .github/workflows/release.yml | 1 + .github/workflows/test.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6e26b85f..49e1c32b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,6 +43,7 @@ jobs: packages: write security-events: write with: + scan_container: true push_dockerhub: true push_ghcr: true secrets: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index cbe6fb85..cbc131e2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -38,6 +38,8 @@ jobs: tests: '["test:onchain","test:proxyless"]' build-docker: uses: digicatapult/shared-workflows/.github/workflows/build-docker.yml@main + with: + scan_container: true permissions: contents: read packages: write From eb69115cbda5240fa0102c923b5ab04f0a4e442f Mon Sep 17 00:00:00 2001 From: "dc-autobot[bot]" <181364585+dc-autobot[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 16:03:39 +0000 Subject: [PATCH 2/3] Updating version to 6.2.137 --- package-lock.json | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index d9cfb62d..f26e88b9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@digicatapult/sqnc-matchmaker-api", - "version": "6.2.136", + "version": "6.2.137", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@digicatapult/sqnc-matchmaker-api", - "version": "6.2.136", + "version": "6.2.137", "license": "Apache-2.0", "dependencies": { "@digicatapult/sqnc-process-management": "^3.0.107", diff --git a/package.json b/package.json index f66e2704..00c4d24f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@digicatapult/sqnc-matchmaker-api", - "version": "6.2.136", + "version": "6.2.137", "description": "An OpenAPI Matchmaking API service for SQNC", "main": "src/index.ts", "type": "module", From d8711542fbda940a9dfae0a53dbef7e1e3169fa5 Mon Sep 17 00:00:00 2001 From: "dc-autobot[bot]" <181364585+dc-autobot[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 21:29:43 +0000 Subject: [PATCH 3/3] Updating version to 6.2.138 --- package-lock.json | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index f26e88b9..3101b827 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@digicatapult/sqnc-matchmaker-api", - "version": "6.2.137", + "version": "6.2.138", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@digicatapult/sqnc-matchmaker-api", - "version": "6.2.137", + "version": "6.2.138", "license": "Apache-2.0", "dependencies": { "@digicatapult/sqnc-process-management": "^3.0.107", diff --git a/package.json b/package.json index 00c4d24f..378c7ec0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@digicatapult/sqnc-matchmaker-api", - "version": "6.2.137", + "version": "6.2.138", "description": "An OpenAPI Matchmaking API service for SQNC", "main": "src/index.ts", "type": "module",