Upgrade: Bump aquasecurity/trivy-action from 0.24.0 to 0.28.0

[dependabot]

Bumps aquasecurity/trivy-action from 0.24.0 to 0.28.0.

Release notes

Sourced from aquasecurity/trivy-action's releases.

v0.28.0

What's Changed

• chore(deps): bump setup-trivy to v0.2.1 by @​DmitriyLewen in aquasecurity/trivy-action#411

Full Changelog: aquasecurity/trivy-action@0.27.0...0.28.0

v0.27.0

What's Changed

• ci: use setup-trivy to install Trivy by @​DmitriyLewen in aquasecurity/trivy-action#406
• chore: update description for scanners and format inputs by @​nikpivkin in aquasecurity/trivy-action#407
• fix: set envs only when passed by @​knqyf263 in aquasecurity/trivy-action#405

Full Changelog: aquasecurity/trivy-action@0.26.0...0.27.0

v0.26.0

What's Changed

• docs: add usage info about action/cache for trivy databases by @​DmitriyLewen in aquasecurity/trivy-action#397
• feat: store artifacts in cache by default by @​knqyf263 in aquasecurity/trivy-action#399

Full Changelog: aquasecurity/trivy-action@0.25.0...0.26.0

v0.25.0

What's Changed

• fix(Makefile): recursive option typo by @​chohner in aquasecurity/trivy-action#371
• chore: use checks bundle snapshot from trivy-action by @​nikpivkin in aquasecurity/trivy-action#388
• Upgrade GitHub actions by @​obounaim in aquasecurity/trivy-action#374
• ci: sync trivy-checks version 1 by @​nikpivkin in aquasecurity/trivy-action#398
• feat(trivy): Bump to support v0.56.1 by @​simar7 in aquasecurity/trivy-action#387

New Contributors

• @​chohner made their first contribution in aquasecurity/trivy-action#371
• @​obounaim made their first contribution in aquasecurity/trivy-action#374

Full Changelog: aquasecurity/trivy-action@0.24.0...0.25.0

Commits

• 915b19b chore(deps): bump setup-trivy to v0.2.1 (#411)
• 5681af8 fix: set envs only when passed (#405)
• 8078967 chore: update description for scanners and format inputs (#407)
• 0fa0cdb ci: use setup-trivy to install Trivy (#406)
• a20de54 feat: store artifacts in cache by default (#399)
• 1b8b83d docs: add usage info about action/cache for trivy databases (#397)
• f781cce feat(trivy): Bump to support v0.56.1 (#387)
• 54f21d8 ci: sync trivy-checks version 1 (#398)
• 89b14e5 Upgrade GitHub actions (#374)
• 97646fe chore: use checks bundle snapshot from trivy-action (#388)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The pull request updates the Trivy vulnerability scanner to the latest version and maintains a reasonable configuration for the scan, focusing on identifying and addressing the most critical vulnerabilities while avoiding noise from lower-severity issues, and using the SARIF output format for easy integration with other security tools.

Expand for full summary

Summary:

The changes in this pull request are focused on improving the security of the CI pipeline by updating the Trivy vulnerability scanner and maintaining a reasonable configuration for the scan. The update to the latest version of Trivy (from 0.24.0 to 0.28.0) is a positive change, as it ensures the pipeline is using the latest version of the tool, which likely includes bug fixes, performance improvements, and support for newer vulnerability databases. The Trivy scan configuration remains the same, with settings that focus on identifying and addressing the most critical vulnerabilities while avoiding noise from lower-severity issues. The use of the SARIF output format is also a good choice, as it can be easily integrated with other security tools and the GitHub Security tab.

Files Changed:

• .github/workflows/ci.yaml: This file contains the GitHub Actions workflow for the continuous integration (CI) pipeline. The main changes are:
  1. Trivy Vulnerability Scanner Update: The version of the Trivy vulnerability scanner action has been updated from 0.24.0 to 0.28.0.
  2. Trivy Scan Configuration: The Trivy scan configuration remains the same, with the following settings:
     • scan-type: "fs": Instructs Trivy to scan the file system of the repository, rather than a container image.
     • ignore-unfixed: true: Tells Trivy to ignore vulnerabilities that have not yet been fixed.
     • format: sarif: The scan results will be output in the SARIF (Static Analysis Results Interchange Format) format.
     • output: "trivy-results.sarif": The SARIF output will be saved to the trivy-results.sarif file.
     • severity: "CRITICAL,HIGH": The pipeline will only report vulnerabilities with a severity of "CRITICAL" or "HIGH".

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.