G-Research
Setup trivy scanning
Should we maybe instead run Trivy daily on the existing latest image + on pull requests and push to master?
This will let us scan what is currently released + avoid pushing vulnerable images
Should we maybe instead run Trivy daily on the existing latest image + on pull requests and push to master? This will let us scan what is currently released + avoid pushing vulnerable images
Yes i think so, TBH i hadn't noticed that the content of this was non-sensicle
@jgiannuzzi i think we should just move the 2 scan items to the docker build action we already have. i don't see the value in doing docker build twice. That also means we don't need to maintain the image name in 2 places which resolves what @greed42 flagged
@eswdd agreed — and as a future improvement, we should also build the Docker image (but not push, of course) on pull requests