diff --git a/.github/containerscan/allowedlist.yaml b/.github/containerscan/allowedlist.yaml deleted file mode 100644 index 1e72aa54961..00000000000 --- a/.github/containerscan/allowedlist.yaml +++ /dev/null @@ -1,34 +0,0 @@ -general: - # Only unfixed should go here - # Order by priority then year then ascending value - vulnerabilities: - # Critical - - CVE-2021-33574 - - CVE-2021-35942 - # High - - CVE-2018-12886 - - CVE-2019-3843 - - CVE-2019-3844 - - CVE-2019-12290 - - CVE-2019-15847 - - CVE-2020-1751 - - CVE-2020-1752 - - CVE-2021-3326 - - CVE-2021-3999 - - CVE-2020-16156 - - CVE-2021-33560 - - CVE-2021-43618 - - CVE-2022-23218 - - CVE-2022-23219 - bestPracticeViolations: - # Fatal - - DKL-DI-0005 # Clear apt-get caches - # Warn - - CIS-DI-0001 # Create a user for the Container - - DKL-DI-0006 # Avoid latest tag - # Info - - CIS-DI-0005 # Enable content trust for Docker - - CIS-DI-0006 # Add HEALTHCHECK instruction to the container image - - CIS-DI-0008 # Confirm safety of setuid/setgid files - # Skip - - DKL-LI-0001 # Avoid empty password diff --git a/.github/workflows/call-build-images.yaml b/.github/workflows/call-build-images.yaml index c9a7ab18774..66304355a5e 100644 --- a/.github/workflows/call-build-images.yaml +++ b/.github/workflows/call-build-images.yaml @@ -115,7 +115,7 @@ jobs: - name: Trivy and Dockle scans uses: azure/container-scan@v0 with: - image-name: ${{ inputs.registry }}/${{ inputs.image }}:${{ matrix.suffix }}-${{ inputs.version }} + registry: ${{ inputs.registry }} username: ${{ inputs.username }} password: ${{ secrets.token }} diff --git a/.github/workflows/pr-image-tests.yaml b/.github/workflows/pr-image-tests.yaml index 049b52acfd4..dd3c582849a 100644 --- a/.github/workflows/pr-image-tests.yaml +++ b/.github/workflows/pr-image-tests.yaml @@ -3,6 +3,7 @@ on: pull_request: paths: - dockerfiles/* + - .github/workflows/*-images.yaml jobs: pr-get-latest-tag: diff --git a/.github/workflows/staging-build.yaml b/.github/workflows/staging-build.yaml index 2d76ba83952..2c000d040ce 100644 --- a/.github/workflows/staging-build.yaml +++ b/.github/workflows/staging-build.yaml @@ -13,7 +13,7 @@ on: version: description: Version of Fluent Bit to build required: true - default: 1.8.11 + default: 1.8.12 # We do not want a new staging build to run whilst we are releasing the current staging build. # We also do not want multiples to run for the same version.