New check idea: find CVEs against the current version of the build platform
Open
Nobody has claimed this yet.
checks
ci services
feature
- Dominant language
- Python
- Stars
- 210
- Forks
- 36
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 2
Description
New check idea: Macaron can look for CVEs against the build platform/CI service version that builds an artifact.
The idea of this new check was originally motivated by this security update from GitLab: https://about.gitlab.com/releases/2023/09/18/security-release-gitlab-16-3-4-released/.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by reviewing the linked GitLab security release and the project’s existing checks to determine how build-platform versions and CVE data are represented. Done means the scope, supported CI services, vulnerability source, and expected reporting behavior are defined.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- gitlab
- Domain
- build-system, ci-cd, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100