rmoff commented on code in PR #15430:
URL: https://github.com/apache/iceberg/pull/15430#discussion_r3100627386
##########
.github/workflows/kafka-connect-ci.yml:
##########
@@ -103,3 +106,67 @@ jobs:
name: test logs
path: |
**/build/testlogs
+ # ------------------------------------------------------------------
+ # Trivy CVE scan
+ #
+ # Scans bundled jars for known vulnerabilities.
+ # Only runs on JVM 21 — dependency CVEs are JVM-independent so
+ # a single scan avoids redundant work.
+ #
+ # Behaviour:
+ # - Flag, don't block: the scan step uses exit-code 1 so it
+ # "fails" when CVEs are found, but continue-on-error keeps
+ # the overall job green. GitHub Actions shows the step with
Review Comment:
OK, I've made this change now, and updated [the above detail &
testing](https://github.com/apache/iceberg/pull/15430#issuecomment-4253937027)
to reflect it.
@rymurr please could you take another look?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
