From 1f0cfa466de89dc4f5bbf1ce9b5f81b99fe4f29c Mon Sep 17 00:00:00 2001 From: Hannes Michalek Date: Mon, 16 Dec 2024 10:11:00 +0100 Subject: [PATCH] Clarify comment [no ci] --- .github/workflows/security-jobs.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/security-jobs.yml b/.github/workflows/security-jobs.yml index 84aa7d0..6428ed5 100644 --- a/.github/workflows/security-jobs.yml +++ b/.github/workflows/security-jobs.yml @@ -34,9 +34,8 @@ jobs: with: SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} - # TODO upload trivy to GitHub Security Tab - # we cannot upload the trivy results to the GitHub Security tab as we're neither a public repository - # nor an Enterprise level user who has access to GitHub "Advanced Security", + # we should be able to upload the trivy results to the GitHub Security tab as we're a public repositor + # but right now it's not worth it # cf https://digitalservicebund.atlassian.net/browse/RISDEV-5193 secrets-scan-with-talisman: # scan for secrets that were published by mistake (we have a pre-commit and pre-push hook, but who knows)