rmoff commented on code in PR #15430:
URL: https://github.com/apache/iceberg/pull/15430#discussion_r3099775865
##########
.github/workflows/kafka-connect-ci.yml:
##########
@@ -103,3 +106,67 @@ jobs:
name: test logs
path: |
**/build/testlogs
+ # ------------------------------------------------------------------
+ # Trivy CVE scan
+ #
+ # Scans bundled jars for known vulnerabilities.
+ # Only runs on JVM 21 — dependency CVEs are JVM-independent so
+ # a single scan avoids redundant work.
+ #
+ # Behaviour:
+ # - Flag, don't block: the scan step uses exit-code 1 so it
+ # "fails" when CVEs are found, but continue-on-error keeps
+ # the overall job green. GitHub Actions shows the step with
Review Comment:
Makes sense, thanks @rymurr. Sounds like a good option.
Out of interest where can I see which checks will block a merge and which
won't?
Re. `exit-code`, don't we still want this to be 1, otherwise the step won't
fail ([it defaults to
0](https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#inputs)) and
show the job as red?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
