meltano
meltano copied to clipboard
Address container scan alerts
The container scans were last run in https://github.com/meltano/meltano/pull/6410, and they revealed the following issues: https://github.com/meltano/meltano/security/code-scanning?query=ref%3Arefs%2Fpull%2F6410%2Fmerge+tool%3AGrype
We expect that many of these will be addressed by
- #3203
This issue exists to address the remaining issues deemed significant enough. In addition to addressing those issues with the images, this issue also includes removing the continue-on-error: true
line from the docker-build-scan-push
action, since from that point onward we'll want to prevent the publication of images which contain issues above some severity level.
https://github.com/meltano/meltano/security/code-scanning
Almost all of the detected issues stem from us using outdated packages for the Meltano webapp (i.e. they were detected in yarn.lock
). Updating those seems like a good first step. @alexmarple thoughts?