feat(ci): add container security scanning workflow - #135
Conversation
|
Warning Review limit reachedNext included review available in 27 minutes. View limit detailsLimit details: You’ve used all 5 included reviews currently available. Your 10 included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
3d73e47 to
7863cc6
Compare
There was a problem hiding this comment.
🟡 Changes recommended
The new workflow references an external reusable workflow via a floating ref/owner mismatch and includes misleading/overbroad SARIF-related permissions/settings that should be corrected before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds a new GitHub Actions workflow intended to run container-focused security checks (Trivy vulnerability scanning + Hadolint Dockerfile linting) by delegating to an org-level reusable workflow.
Changes:
- Introduces
.github/workflows/container-security.ymlto run container security scanning on Docker-related changes and on a weekly schedule. - Configures concurrency, permissions, and reusable-workflow inputs for image build + scan and linting.
File summaries
| File | Description |
|---|---|
.github/workflows/container-security.yml |
Adds a workflow that delegates container security scanning to a reusable workflow with configured triggers, permissions, and inputs. |
Review details
Suppressed comments (1)
.github/workflows/container-security.yml:51
upload-sarifis deprecated/no-op in the referenced reusable workflow; leaving it enabled here is misleading because it suggests results will be ingested into the Security tab. Consider not passing this input to avoid confusion.
generate-sbom: true
upload-sarif: true
- Files reviewed: 1/1 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| jobs: | ||
| container-security: | ||
| name: Container Security Scan | ||
| uses: williaby/.github/.github/workflows/python-container-security.yml@main |
| on: | ||
| push: | ||
| branches: [main, master] | ||
| paths: |
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| packages: read |
Pull request was closed
Adds Trivy + Hadolint container security scanning. This repo has a Dockerfile and was identified as missing this workflow during the Docker repo inventory audit.