aquasecurity / aquasecurity/setup-trivy
Is a `version-file` input worth adding?
- Dominant language
- No language data
- Stars
- 15
- Forks
- 25
- PR merge metrics
- No merged PRs in 30d
Description
I opened #39 to add a `version-file` input, and @DmitriyLewen asked me to file
an issue so you can gauge whether anyone actually wants it before spending
review time on the PR.
What I'm after: I keep tool versions in one file at the repo root and read them
from CI, so bumping a version is a single edit instead of one per workflow.
setup-go, setup-node and setup-terraform all take a `*-version-file` for this.
setup-trivy is the one place I still hard-code it.
Dmitriy's objection is fair — Trivy has no version file of its own, so anything
the action reads is a convention users brought with them. That is why #39 reads
two shapes rather than inventing one: asdf's `.tool-versions` (the `trivy`
line), which is a real cross-tool convention, and a plain file holding just the
version.
This doesn't overlap with #34, which asks for the default to be pinned for
security reasons. That one is about people who don't pin at all; this is about
people who already pin and want one place to do it.
If you'd use this, a 👍 or a note about which file you keep versions in would
help. If there's no interest, I'm happy for #39 to be closed.
Contributor guide
Research direction
Start by reading the linked #39 proposal and the discussion referenced here. Compare the two supported version-file shapes described in the issue—asdf's .tool-versions and a plain version file—and use the requested user feedback to determine whether the feature has enough interest to proceed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100