Skip to content

Commit 90e7cbb

Browse files
sbp-bvanbsbp-bvanb
committed
fix: remove trivy
1 parent e63afd5 commit 90e7cbb

4 files changed

Lines changed: 32 additions & 102 deletions

File tree

‎.github/workflows/golang.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,12 @@ jobs:
1212
- testing-type: opa
1313
- testing-type: security-golang-modules
1414
- testing-type: security-grype
15-
- testing-type: security-trivy
16-
security-trivyignore: ""
1715
runs-on: ubuntu-24.04
1816
env:
1917
TASK_X_REMOTE_TASKFILES: 1
2018
steps:
2119
- uses: actions/checkout@v6.0.2
2220
- uses: ./
2321
with:
24-
security-trivyignore: ${{ matrix.args.security-trivyignore }}
2522
task-install: yes
2623
testing-type: ${{ matrix.args.testing-type }}

‎CLAUDE.md‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
99
- A GitHub Action ([action.yml](action.yml)) for CI/CD pipelines
1010
- A remote Taskfile ([build/task.yml](build/task.yml)) for local development and CI automation
1111

12-
The action orchestrates: Go version installation (from go.mod), module verification, security scanning (osv-scanner, Grype, Trivy), golangci-lint, unit/integration/component tests, code coverage enforcement, and optional binary releases.
12+
The action orchestrates: Go version installation (from go.mod), module verification, security scanning (osv-scanner, Grype), golangci-lint, unit/integration/component tests, code coverage enforcement, and optional binary releases.
1313

1414
## Architecture
1515

@@ -20,7 +20,7 @@ The action orchestrates: Go version installation (from go.mod), module verificat
2020
- Defines all inputs (build-tags, testing-type, release configs, etc.)
2121
- Orchestrates installation of Go and Task runner
2222
- Conditionally executes different testing/security/build workflows based on `testing-type` input
23-
- Supports multiple testing types: `unit`, `integration`, `component`, `coverage`, `lint`, `security-golang-modules`, `security-grype`, `security-trivy`, `graphql-lint`, `mcvs-texttidy`, `mocks-tidy`, `opa`
23+
- Supports multiple testing types: `unit`, `integration`, `component`, `coverage`, `lint`, `security-golang-modules`, `security-grype`, `graphql-lint`, `mcvs-texttidy`, `mocks-tidy`, `opa`
2424

2525
2. **build/task.yml** - Reusable Taskfile
2626

@@ -55,11 +55,6 @@ Tests are organized using Go build tags:
5555
- Triggered when `testing-type: security-grype`
5656
- Severity cutoff: HIGH or above
5757

58-
3. **Trivy** - Optional container/filesystem scanning
59-
- Triggered when `testing-type: security-trivy`
60-
- Supports custom ignore file via `.trivyignore`
61-
- Uses cached databases from public.ecr.aws to avoid rate limits
62-
6358
## Common Development Commands
6459

6560
### Using the Remote Taskfile (in consuming projects)
@@ -120,10 +115,12 @@ task remote:fix-linting-issues --yes
120115
```
121116

122117
This task uses:
118+
123119
- **golines** (v0.12.2) - Reformats code to meet line length requirements by intelligently wrapping long lines
124120
- **wsl** (v5.1.0) - Fixes whitespace linting issues by adding/removing blank lines according to Go style guidelines
125121

126122
The task runs:
123+
127124
1. `golines . -w` - Reformats all Go files in the current directory
128125
2. `wsl -fix ./...` - Fixes whitespace issues in all Go packages
129126

@@ -207,7 +204,7 @@ For building binaries on tagged releases:
207204

208205
### Key Action Inputs
209206

210-
- **testing-type** - Main selector: `unit`, `integration`, `component`, `coverage`, `lint`, `security-golang-modules`, `security-grype`, `security-trivy`
207+
- **testing-type** - Main selector: `unit`, `integration`, `component`, `coverage`, `lint`, `security-golang-modules`, `security-grype`
211208
- **build-tags** - Build constraints for tests/linting (e.g., "integration,component")
212209
- **golang-unit-tests-exclusions** - Regex to exclude packages from unit tests (e.g., `\(cmd\/app\|internal\/app\)`)
213210
- **code-coverage-expected** - Minimum coverage percentage (default: 80)

‎README.md‎

Lines changed: 26 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ task remote:fix-linting-issues --yes
118118
```
119119

120120
This task automatically fixes common linting issues using two tools:
121+
121122
- **golines**: Reformats Go code to meet line length requirements (wraps long lines)
122123
- **wsl**: Fixes whitespace linting issues (adds/removes blank lines according to style rules)
123124

@@ -150,6 +151,7 @@ Build tags (also known as build constraints) allow you to include or exclude Go
150151
### Using Build Tags
151152

152153
When running tests with specific build tags:
154+
153155
```zsh
154156
# Run integration tests
155157
task remote:test-integration --yes
@@ -159,6 +161,7 @@ task remote:test-component --yes
159161
```
160162

161163
When linting code with specific build tags, you may need to run the linter multiple times to cover all code paths:
164+
162165
```yml
163166
- testing-type: "lint" # Lint main code
164167
- testing-type: "lint", build-tags: "integration" # Lint integration test code
@@ -238,8 +241,6 @@ jobs:
238241
- testing-type: "mocks-tidy"
239242
- testing-type: "security-golang-modules"
240243
- testing-type: "security-grype"
241-
- testing-type: "security-trivy"
242-
security-trivyignore: ""
243244
- testing-type: "unit"
244245
runs-on: ubuntu-24.04
245246
env:
@@ -259,7 +260,6 @@ jobs:
259260
release-architecture: ${{ matrix.args.release-architecture }}
260261
release-dir: ${{ matrix.args.release-dir }}
261262
release-type: ${{ matrix.args.release-type }}
262-
security-trivyignore: ${{ matrix.args.security-trivyignore }}
263263
task-install: yes
264264
testing-type: ${{ matrix.args.testing-type }}
265265
token: ${{ secrets.GITHUB_TOKEN }}
@@ -271,33 +271,29 @@ and a [.golangci.yml](https://golangci-lint.run/usage/configuration/).
271271

272272
<!-- markdownlint-disable MD013 -->
273273

274-
| Option | Default | Required | Description |
275-
| :---------------------------------------------- | :------ | -------- | :--------------------------------------------------------------------------------------------------------------- |
276-
| build-tags | x | | Build tags to use when running tests and linting (e.g., "integration", "component", "e2e") |
277-
| code-coverage-expected | x | | Minimum expected code coverage percentage for standard tests |
278-
| code-coverage-opa-expected | x | | Minimum expected code coverage percentage for OPA (Open Policy Agent) tests |
279-
| code-coverage-timeout | | | Timeout duration for code coverage analysis (e.g., "10m0s") |
280-
| github-token-for-downloading-private-go-modules | | | GitHub token with permissions to download Go modules from private repositories |
281-
| golangci-timeout | x | | Timeout duration for golangci-lint execution |
282-
| golang-unit-tests-exclusions | x | | Regex pattern to exclude specific packages from unit testing (e.g., `\(cmd\/app\|internal\/app\)`) |
283-
| grype-version | | | Specific version of Grype vulnerability scanner to use |
284-
| gta-base-branch | x | | The branch changed go packages will be compared to, to perform partial tests |
285-
| gta-partial-testing | x | | Whether to run partial tests (true or false) |
286-
| release-application-name | | | Name of the application binary to build (required when release-type is set) |
287-
| release-architecture | | | Target architecture for the binary (e.g., "amd64", "arm64") |
288-
| release-build-tags | | | Build tags to use when building the release binary (e.g., "lambda.norpc") |
289-
| release-dir | | | Directory containing the main.go file for the binary to build |
290-
| release-os | x | | Target operating system for the binary (e.g., "linux", "darwin") |
291-
| release-type | | | Type of release to build (e.g., "binary") |
292-
| task-install | x | | Whether to install Task runner ("yes" or "no") |
293-
| task-version | x | | Version of Task runner to install |
294-
| testing-type | | | Type of testing to run (e.g., "unit", "integration", "lint", "coverage", "security-golang-modules") |
295-
| test-timeout | | | Timeout duration for test execution (e.g., "10m0s") |
296-
| token | | | GitHub token for authentication (typically ${{ secrets.GITHUB_TOKEN }}) |
297-
| trivy-action-db | x | | Trivy vulnerability database configuration |
298-
| trivy-action-java-db | x | | Trivy Java vulnerability database configuration |
299-
| trivy-version | x | | Trivy CLI version used by aquasecurity/trivy-action (for example, "v0.69.2") |
300-
274+
| Option | Default | Required | Description |
275+
| :---------------------------------------------- | :------ | -------- | :-------------------------------------------------------------------------------------------------- |
276+
| build-tags | x | | Build tags to use when running tests and linting (e.g., "integration", "component", "e2e") |
277+
| code-coverage-expected | x | | Minimum expected code coverage percentage for standard tests |
278+
| code-coverage-opa-expected | x | | Minimum expected code coverage percentage for OPA (Open Policy Agent) tests |
279+
| code-coverage-timeout | | | Timeout duration for code coverage analysis (e.g., "10m0s") |
280+
| github-token-for-downloading-private-go-modules | | | GitHub token with permissions to download Go modules from private repositories |
281+
| golangci-timeout | x | | Timeout duration for golangci-lint execution |
282+
| golang-unit-tests-exclusions | x | | Regex pattern to exclude specific packages from unit testing (e.g., `\(cmd\/app\|internal\/app\)`) |
283+
| grype-version | | | Specific version of Grype vulnerability scanner to use |
284+
| gta-base-branch | x | | The branch changed go packages will be compared to, to perform partial tests |
285+
| gta-partial-testing | x | | Whether to run partial tests (true or false) |
286+
| release-application-name | | | Name of the application binary to build (required when release-type is set) |
287+
| release-architecture | | | Target architecture for the binary (e.g., "amd64", "arm64") |
288+
| release-build-tags | | | Build tags to use when building the release binary (e.g., "lambda.norpc") |
289+
| release-dir | | | Directory containing the main.go file for the binary to build |
290+
| release-os | x | | Target operating system for the binary (e.g., "linux", "darwin") |
291+
| release-type | | | Type of release to build (e.g., "binary") |
292+
| task-install | x | | Whether to install Task runner ("yes" or "no") |
293+
| task-version | x | | Version of Task runner to install |
294+
| testing-type | | | Type of testing to run (e.g., "unit", "integration", "lint", "coverage", "security-golang-modules") |
295+
| test-timeout | | | Timeout duration for test execution (e.g., "10m0s") |
296+
| token | | | GitHub token for authentication (typically ${{ secrets.GITHUB_TOKEN }}) |
301297

302298
Note: If an **x** is registered in the Default column, refer to the
303299
[action.yml](action.yml) for the corresponding value.

‎action.yml‎

Lines changed: 1 addition & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,6 @@ inputs:
6464
release-type:
6565
description: |
6666
The type of the release, e.g. binary, zip, etc.
67-
security-trivyignore:
68-
default: ".trivyignore"
69-
description: |
70-
Whether to ignore certain Trivy vulnerabilities or not.
7167
task-install:
7268
default: no
7369
description: |
@@ -85,20 +81,7 @@ inputs:
8581
The testing type, e.g. integration, unit or some other.
8682
token:
8783
description: |
88-
A token is required to allow the mcvs-golang-action to pull the
89-
cached trivy DBs to prevent bump into rate limits.
90-
trivy-action-db:
91-
default: "public.ecr.aws/aquasecurity/trivy-db:2"
92-
description: |
93-
OCI repository to retrieve trivy-db from.
94-
trivy-action-java-db:
95-
default: "public.ecr.aws/aquasecurity/trivy-java-db:1"
96-
description: |
97-
OCI repository to retrieve trivy-java-db from.
98-
trivy-version:
99-
default: "v0.69.2"
100-
description: |
101-
The Trivy CLI version used by aquasecurity/trivy-action.
84+
A token could be used to pull private golang modules.
10285
runs:
10386
using: "composite"
10487
steps:
@@ -189,49 +172,6 @@ runs:
189172
path: "."
190173
severity-cutoff: high
191174
#
192-
# * Trivy
193-
#
194-
- uses: 030/trivyignore-validator-action@v0.1.2
195-
if: inputs.token != '' && inputs.testing-type == 'security-trivy'
196-
- name: Log in to GitHub Packages Docker registry
197-
if: inputs.token != '' && inputs.testing-type == 'security-trivy'
198-
shell: bash
199-
run: |
200-
echo "${{ inputs.token }}" |\
201-
docker login ghcr.io -u ${{ github.actor }} --password-stdin
202-
#
203-
# Duplicated trivy-action parameters as GitHub actions do NOT support
204-
# anchors: https://github.com/actions/runner/issues/1182
205-
#
206-
- uses: aquasecurity/trivy-action@0.35.0
207-
if: inputs.token != '' && inputs.testing-type == 'security-trivy'
208-
env:
209-
TRIVY_DB_REPOSITORY: ${{ inputs.trivy-action-db }}
210-
TRIVY_JAVA_DB_REPOSITORY: ${{ inputs.trivy-action-java-db }}
211-
TRIVY_PASSWORD: ${{ inputs.token }}
212-
TRIVY_USERNAME: ${{ github.actor }}
213-
with:
214-
scan-type: "fs"
215-
scan-ref: "."
216-
version: ${{ inputs.trivy-version }}
217-
exit-code: "1"
218-
ignore-unfixed: true
219-
severity: "CRITICAL,HIGH"
220-
trivyignores: ${{ inputs.security-trivyignore }}
221-
- uses: aquasecurity/trivy-action@0.35.0
222-
if: inputs.token == '' && inputs.testing-type == 'security-trivy'
223-
env:
224-
TRIVY_DB_REPOSITORY: ${{ inputs.trivy-action-db }}
225-
TRIVY_JAVA_DB_REPOSITORY: ${{ inputs.trivy-action-java-db }}
226-
with:
227-
scan-type: "fs"
228-
scan-ref: "."
229-
version: ${{ inputs.trivy-version }}
230-
exit-code: "1"
231-
ignore-unfixed: true
232-
severity: "CRITICAL,HIGH"
233-
trivyignores: ${{ inputs.security-trivyignore }}
234-
#
235175
# Run golangci-lint.
236176
#
237177
- name: golangci-lint

0 commit comments

Comments
 (0)