Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 14 Packages Projects Releases Wiki Activity

Drop Trivy misconfig scanner to restore prior scope (#46769)

Browse Source
This commit is contained in:
Luke Heath
2026-06-03 15:13:37 -05:00
committed by GitHub
parent 2a01bc1d6d
commit ac733b91ef
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/trivy-scan.yml
+4 -3
View File
@@ -123,9 +123,10 @@ jobs:
scan-type: "fs"
ignore-unfixed: false
# PR/push: only scan for secrets (block leaked credentials before merge).
# Schedule/manual: full scan (vuln + secret + misconfig) with SARIF upload
# to the Security tab for triage. CVEs are tracked nightly, not per-PR.
scanners: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'vuln,secret,misconfig' || 'secret' }}
# Schedule/manual: vuln + secret with SARIF upload to the Security tab
# for triage. CVEs are tracked nightly, not per-PR. Misconfig is
# intentionally excluded; revisit after the SOC 2 audit.
scanners: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'vuln,secret' || 'secret' }}
format: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'sarif' || 'table' }}
output: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && 'trivy-results.sarif' || '' }}
exit-code: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '0' || '1' }}