microsoft / microsoft/security-devops-azdevops
Allow specifying minor versions of tools or automatic selection of the latest
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
Feature Request: Allow us to specify minor version of the underlying tools
Quite often there are warnings and issues with the tools bundled with guardian/SDO.
I understand the need to somewhat control versions in other to know what "works" from an integration perspective, and freely allowing major version changes may be quite troublesome.
That said if we could have an override that allowed us to either specify a version to use, say TrivyVersion = 0.68.0 (allowing us to upgrade to all minor versions before 1.00 for instance), or alternatively a "TrivyUseLatestMinor=true" that would help alleviate the pains we have with the warnings/errors that are surfaced in the included tools and not directly by SDO.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the configuration handling for the proposed TrivyVersion and TrivyUseLatestMinor settings, then trace how bundled tool versions are selected. Done should support an explicit minor-version policy or latest-minor selection while preserving the existing major-version compatibility boundary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100