Adarsh-Me commented on issue #825: URL: https://github.com/apache/celix/issues/825#issuecomment-5949675556
@pnoltes triage plan: keep the decisions in-repo as a CycloneDX VEX file with `not_affected` + justification per CVE, so each scan is diffed against it instead of re-triaged by hand. And a correction to my own plan: Trivy can scan the checkout directly (`trivy fs`), so #825 need not wait on #845's SBOM artifact. Report-only plus SARIF to code scanning first, gating later. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
