Add vulnerability scanning in CI
Open
build/environment
good first issue
help wanted
kind/wish
- Dominant language
- C
- Stars
- 193
- Forks
- 99
- Avg merge
- 1m
- Merged PRs (30d)
- 1
Description
Add **vulnerability scanning** to the CI pipeline based on the generated SBOM.
### Scope
* Scan SBOM build artefact for **known vulnerabilities (CVE / CVSS)**
* Use **OSS tooling** (e.g. grype, trivy, osv-scanner)
* Initial setup is **report-only** (no CI gating)
* Bonus: add CI gating for issues with a CVSS of 9 or higher.
tool recommendations are welcome.
### Expected outcome
* CI job that performs vulnerability scanning
* Machine-readable scan output published as a CI artifact
* Short documentation describing:
* which tool is used
* what is (and is not) covered
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.