Github workflow for scanning CVEs
- Dominant language
- Scala
- Stars
- 44k
- Forks
- 29.4k
- PR merge metrics
- No merged PRs in 30d
Description
I saw mentions of the lack of CVE scan for Spark. We added this github workflow to the Iceberg project to scan artifacts the project produces: https://github.com/apache/iceberg/blob/main/.github/workflows/cve-scan.yml
Free feel to adjust for this repo.
It uses a [sandboxed version of trivy](https://github.com/apache/iceberg/blame/main/.github/workflows/cve-scan.yml#L216): `lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0` that is already blessed by ASF Infra
Contributor guide
Research direction
Use Apache Iceberg’s .github/workflows/cve-scan.yml as the reference, and first inspect how this repository produces its artifacts. Adapt the workflow for Spark using the ASF-blessed sandboxed-trivy-action commit shown in the issue. Done means the GitHub workflow scans the artifacts Spark produces and reports CVEs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100