Skip to content

Commit

Permalink
ci: do not fail the build if vulnerabilities are found
Browse files Browse the repository at this point in the history
The `exit-code` resulted in build failures even for LOW, MEDIUM
vulnerabilites with trivy-action 0.14.0, since the `severity`
configuration is ignored for `sarif` format unless we also set
`limit-severities-for-sarif` (but we want the full report).
  • Loading branch information
kaibernhard committed Nov 8, 2023
1 parent ae2fdbd commit b30f027
Showing 1 changed file with 0 additions and 2 deletions.
2 changes: 0 additions & 2 deletions .github/workflows/pipeline.yml
Original file line number Diff line number Diff line change
Expand Up @@ -109,8 +109,6 @@ jobs:
image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
format: "sarif"
output: "trivy-results.sarif"
severity: "CRITICAL,HIGH"
exit-code: "1" # Fail the build!
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
if: ${{ always() && github.ref == 'refs/heads/main' }} # Bypass non-zero exit code..
Expand Down

0 comments on commit b30f027

Please sign in to comment.