fix(ci): bump reusable-trivy.yml pin to include GHCR-auth fix - #60
Merged
Conversation
v0.1.1's gate-image job failed on the pinned commit (ca91728) because the image job never authenticated to GHCR before scanning by digest, so every one of Trivy's image-source backends failed. Fixed at attested-delivery/.github#33 (ee1f93b). Bump all three references in this repo (release.yml's IaC-scan and gate-image jobs, quality-gates .yml's PR-time trivy job) so the fix actually takes effect.
There was a problem hiding this comment.
Pull request overview
This PR updates the pinned commit SHA for the shared reusable-trivy.yml GitHub Actions workflow to a newer upstream commit that includes a fix for missing GHCR authentication when scanning container images by digest. This keeps the repo’s release and PR-time security gates aligned with the corrected central workflow.
Changes:
- Bump
reusable-trivy.ymlpin inrelease.ymlfor both the IaC-only scan and the image (digest) scan gate. - Bump
reusable-trivy.ymlpin inquality-gates.ymlfor the PR-time IaC/license scan. - Expand inline comments in
release.ymlto document the reason for the pin bump (GHCR auth fix).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Updates the pinned reusable-trivy.yml commit for release-time IaC and image scanning jobs to include the GHCR auth fix. |
| .github/workflows/quality-gates.yml | Updates the pinned reusable-trivy.yml commit for PR/merge-time Trivy scanning to the same fixed upstream commit. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v0.1.1'sgate-image / imagejob failed (job 86817144520) because the pinnedreusable-trivy.ymlcommit never authenticated to GHCR before scanning an image by digest. Fixed upstream at attested-delivery/.github#33 (merged atee1f93b).Change
Bumps all three references to
reusable-trivy.ymlin this repo (release.yml's IaC-only scan job, release.yml'sgate-imagejob, quality-gates.yml's PR-time trivy job) to the fixed commit.Verification
actionlintpasses clean on both changed files.just checkpasses clean.Next tag after this merges gets a fully green release run (static-artifact path + container image, including the vulnerability-scan attestation that
v0.1.1is currently missing — see go-htmx#10's closing summary).