Do not start Trivy scan if changes not related to dependencies.
Run Trivy on daily bases.
Add badge to follow cycle Trivy scans
Enable scans on request

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true
Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true

Required-githooks: true
Signed-off-by: Tomasz Gromadzki <[email protected]>

https://aquasecurity.github.io/trivy/v0.56/docs/coverage/language/#supported-languages
provides the full list of scanned file in the 'filesystem' scan.

Keep the same condition for PR and merge trigger.

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

)

In reintegrate case, ever hit case that the IC_CONT_CAPA cache is valid locally
but cont open handle invalid (not in dt_cont_hdl_hash). For this case
invalidate local IV cache first and retry again, to avoid in-flight UPDATE's
failure because obj_ioc_init() -> ds_cont_find_hdl() ->
cont_iv_hdl_fetch() failure -
DBUG src/engine/server_iv.c:409 ivc_on_fetch() FETCH: Key [1:7] entry 0x7fb31063b550 valid yes
DBUG src/engine/server_iv.c:1042 iv_op_internal() class_id 7 opc 1 rc 0
ERR  src/object/srv_obj.c:2174 obj_ioc_begin_lite()
Failed to initialize object I/O context.: DER_NO_HDL(-1002): 'Invalid handle'

Signed-off-by: Xuezhao Liu <[email protected]>

- Use GHA cache to avoid Trivy scan failure
Trivy CVEs database downloads fails often.
The most promissing solution is to use cache and download the
database once a day.
CVEs database is cached during daily build (`schedule`).
Cache is not used if `master` branch cache is not available.
https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#updating-caches-in-the-default-branch

- Avoid Trivy scanners re-initialization
https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#skipping-setup-when-calling-trivy-action-multiple-times
The latest available version of `aquasecurity/trivy-action`
is used to be able to use `skip-setup-trivy` parameter.

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true
Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

- Use GHA cache to avoid Trivy scan failure
Trivy CVEs database downloads fails often.
The most promissing solution is to use cache and download the
database once a day.
CVEs database is cached during daily build (`schedule`).
Cache is not used if `master` branch cache is not available.
https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#updating-caches-in-the-default-branch

- Avoid Trivy scanners re-initialization
https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#skipping-setup-when-calling-trivy-action-multiple-times
The latest available version of `aquasecurity/trivy-action`
is used to be able to use `skip-setup-trivy` parameter.

Doc-only: true

Required-githooks: true
Signed-off-by: Tomasz Gromadzki <[email protected]>

Doc-only: true

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Use external caching mechanism to ensure PR scan not failing.

Signed-off-by: Tomasz Gromadzki <[email protected]>

Signed-off-by: Tomasz Gromadzki <[email protected]>

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>

Required-githooks: true

Signed-off-by: Tomasz Gromadzki <[email protected]>