Draft
SEP-1869: Add recurring Trivy scan gate to CI for the SEP container image#1386
Conversation
Co-authored-by: yyyyyyyan <24644216+yyyyyyyan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] SEP-1869: Add recurring Trivy scan gate to CI for the SEP container image
SEP-1869: Add recurring Trivy scan gate to CI for the SEP container image
Aug 20, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Trivy vulnerability scanning for the SEP container image, including relevant CI path triggers.
Changes:
- Triggers container builds for Trivy configuration and CI changes.
- Installs Trivy v0.69.3 and scans for HIGH/CRITICAL vulnerabilities.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+340
to
+343
| - name: Install Trivy | ||
| run: | | ||
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ | ||
| | sh -s -- -b /usr/local/bin v0.69.3 |
Comment on lines
+342
to
+343
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ | ||
| | sh -s -- -b /usr/local/bin v0.69.3 |
Comment on lines
+345
to
+351
| - name: Trivy image scan | ||
| run: >- | ||
| trivy image | ||
| --ignorefile .trivyignore.yaml | ||
| --severity HIGH,CRITICAL | ||
| --exit-code 1 | ||
| "sep:HEAD" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.trivyignore.yaml(added by SEP-1864) is inert — no CI step invokes Trivy, so dependency bumps can silently reintroduce HIGH/CRITICAL CVEs with nothing to catch it.Changes
changesjob): added.trivyignore.yamland.github/workflows/ci.ymlto thesidecarfilter so edits to either file trigger thebuildjob — including this PR itself.buildjob): after the existing smoke tests, installs Trivy v0.69.3 (matching the version.trivyignore.yamlentries were validated against) and scanssep:HEAD:--ignorefileis required because Trivy's default ignore file is.trivyignore(no.yamlextension) — without it the YAML-format exception list is silently ignored and all twelve accepted findings re-fail.Heads-up
The current
.trivyignore.yamlentries carryexpired_at: 2027-02-19. After that date the gate will start failing on its own until the entries are revisited.