aquasecurity / aquasecurity/setup-trivy

Is a `version-file` input worth adding?

Open
#41 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
No language data
Stars
15
Forks
25
PR merge metrics
No merged PRs in 30d

Description

I opened #39 to add a `version-file` input, and @DmitriyLewen asked me to file
an issue so you can gauge whether anyone actually wants it before spending
review time on the PR.

What I'm after: I keep tool versions in one file at the repo root and read them
from CI, so bumping a version is a single edit instead of one per workflow.
setup-go, setup-node and setup-terraform all take a `*-version-file` for this.
setup-trivy is the one place I still hard-code it.

Dmitriy's objection is fair — Trivy has no version file of its own, so anything
the action reads is a convention users brought with them. That is why #39 reads
two shapes rather than inventing one: asdf's `.tool-versions` (the `trivy`
line), which is a real cross-tool convention, and a plain file holding just the
version.

This doesn't overlap with #34, which asks for the default to be pinned for
security reasons. That one is about people who don't pin at all; this is about
people who already pin and want one place to do it.

If you'd use this, a 👍 or a note about which file you keep versions in would
help. If there's no interest, I'm happy for #39 to be closed.

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked #39 proposal and the discussion referenced here. Compare the two supported version-file shapes described in the issue—asdf's .tool-versions and a plain version file—and use the requested user feedback to determine whether the feature has enough interest to proceed.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.