Add aquasecurity/trivy-action

[lhotari]

Request for adding a new GitHub Action to the allow list

Overview

GitHub Action for Trivy security scanner.

Name of action:
aquasecurity/trivy-action

URL of action:
https://github.com/marketplace/actions/aqua-security-trivy
https://github.com/aquasecurity/trivy-action

Version to pin to (branch, tag, hash):
0.31.0

Checklist

You should be able to check most of these boxes for an action to be considered for review.
Please check all boxes that currently apply:

• The action is listed in the GitHub Actions Marketplace
• The action is not already on the list of approved actions
• The action has a sufficient number of contributors or has contributors within the ASF community
• The action has a clearly defined license
• The action is actively developed or maintained
• The action has CI/unit tests configured

[assignUser]

Same here, please pin the SHA of the latest release.

[assignUser]

The actions uses aquasecurity/[email protected] which is not pinned to a sha (funny how the security scanner is not following best practice ^^) so that will prevent this to run even after the PR is merged.

I commented on the related issue that hasn't gotten much attention: aquasecurity/trivy-action#423

[lhotari]

The actions uses aquasecurity/[email protected] which is not pinned to a sha (funny how the security scanner is not following best practice ^^) so that will prevent this to run even after the PR is merged.

I commented on the related issue that hasn't gotten much attention: aquasecurity/trivy-action#423

@assignUser Thanks for the great analysis. I opened PR aquasecurity/trivy-action#456 to address the issue in trivy-action.

[assignUser]

@lhotari the fix was released with 0.31.0 if you rebase and update the hashes we can proceed with this!

[lhotari]

@lhotari the fix was released with 0.31.0 if you rebase and update the hashes we can proceed with this!

rebased and added the hash for 0.31.0 . Please review @assignUser . I didn't remove * since I guess it will expire soon.

[raboof]

If I understand correctly Trivy is a 'verified creator' and for that reason doesn't need to be allowlisted. If that's true (I'm 85% confident) we should probably document that instead of allowlisting this action?

[assignUser]

@raboof I am 100% against having that setting turned on and we will turn that off once we turn the tags and wildcards off too I would guess.

@lhotari could you remove the wildcard please? We won't be adding any new ones, just keeping the legacy ones around.

[assignUser]

@dfoulks1 ?