Supply-chain scanning in the CI pipeline (Trivy/Grype + Gitleaks) #29
Labels
No labels
area/ci
area/media
area/network
area/observability
area/platform
area/security
area/storage
area/web
type/project
type/task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
itguyeric/infra#29
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add security gates to the Forgejo Actions pipeline. Scan every built bootc image for known CVEs with Trivy or Grype, and scan the repos for committed secrets with Gitleaks. Optionally sign images with cosign so deploys can verify provenance.
Slots in as post-build steps, report-only at first, then promoted to hard gates once the baseline is clean. Good hardening for the fleet and a strong talk and portfolio story for the DevRel side.