almet/dangerzone
1
0
Fork 0
mirror of https://github.com/freedomofpress/dangerzone.git synced 2025-04-28 18:02:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

ci: Make our security scans stricter

Browse source 
Our security scans previously alerted us on critical CVEs that have a
fix. In this commit, we ask to be alerted on CVEs that don't have a fix
yet, so that we can have them in our radar.

Since the introduction of these security checks, we have only once
encountered a case where our container was vulnerable to a CVE that
Alpine Linux had not fixed yet. This means that the maintenance burden
of this change will probably be minimal.
This commit is contained in:
Alex Pyrgiotis 2023-12-06 12:09:41 +02:00
parent 7fc797f913
commit 7f50ad2e48
No known key found for this signature in database
GPG key ID: B6C15EBA0357C9AA
2 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
.github/workflows/scan.yml vendored
View file

@ -22,7 +22,7 @@ jobs:
with:
image: "dangerzone.rocks/dangerzone:latest"
fail-build: false
only-fixed: true
only-fixed: false
severity-cutoff: critical
- name: Upload container scan report
uses: github/codeql-action/upload-sarif@v2
@ -36,7 +36,7 @@ jobs:
with:
image: "dangerzone.rocks/dangerzone:latest"
fail-build: true
only-fixed: true
only-fixed: false
severity-cutoff: critical
security-scan-app:
@ -52,7 +52,7 @@ jobs:
with:
path: "."
fail-build: false
only-fixed: true
only-fixed: false
severity-cutoff: critical
- name: Upload application scan report
uses: github/codeql-action/upload-sarif@v2
@ -66,5 +66,5 @@ jobs:
with:
path: "."
fail-build: true
only-fixed: true
only-fixed: false
severity-cutoff: critical

8
.github/workflows/scan_released.yml vendored
View file

@ -23,7 +23,7 @@ jobs:
with:
image: "dangerzone.rocks/dangerzone:latest"
fail-build: false
only-fixed: true
only-fixed: false
severity-cutoff: critical
- name: Upload container scan report
uses: github/codeql-action/upload-sarif@v2
@ -37,7 +37,7 @@ jobs:
with:
image: "dangerzone.rocks/dangerzone:latest"
fail-build: true
only-fixed: true
only-fixed: false
severity-cutoff: critical
security-scan-app:
@ -59,7 +59,7 @@ jobs:
with:
path: "."
fail-build: false
only-fixed: true
only-fixed: false
severity-cutoff: critical
- name: Upload application scan report
uses: github/codeql-action/upload-sarif@v2
@ -73,5 +73,5 @@ jobs:
with:
path: "."
fail-build: true
only-fixed: true
only-fixed: false
severity-cutoff: critical