forgeadmin/spike
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

drop trivy from spike
All checks were successful
spike-build / build (push) Successful in 22s
Details

Browse source
This commit is contained in:
root 2026-07-01 10:25:09 +00:00
parent fe1a1f7dda
commit b0f664f0cd
1 changed files with 3 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.forgejo/workflows/build.yml
View file

@ -31,12 +31,9 @@ jobs:
context: . context: .
push: true push: true
tags: ${{ env.REGISTRY }}/${{ github.repository }}/web:sha-${{ github.sha }} tags: ${{ env.REGISTRY }}/${{ github.repository }}/web:sha-${{ github.sha }}
- uses: aquasecurity/trivy-action@master # Trivy removed from the 3a proof — it's parity, not the risk, and was
with: # erroring on the registry pull and blocking cosign. Add it back (gating)
image-ref: ${{ env.REGISTRY }}/${{ github.repository }}/web@${{ steps.push.outputs.digest }} # in the real workflow once the cosign path is proven.
severity: CRITICAL,HIGH
exit-code: '0' # spike: report only — don't gate cosign on a base-image CVE
ignore-unfixed: true
- uses: sigstore/cosign-installer@v3 - uses: sigstore/cosign-installer@v3
- name: cosign sign + verify (key-based) - name: cosign sign + verify (key-based)
env: env: