From c26d2de616ad69bce11762c364ca3e8abdcc34bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90=E1=BB=97=20Tr=E1=BB=8Dng=20H=E1=BA=A3i?= <41283691+hainenber@users.noreply.github.com> Date: Sat, 21 Mar 2026 12:24:24 +0700 Subject: [PATCH] fix(sec): remove compromised Trivy actions (#38780) Signed-off-by: hainenber (cherry picked from commit 7004369c68afa672c70884533d69f788e71e5358) --- .github/workflows/docker.yml | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index e17da498eeb..60ff6c3873f 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -14,7 +14,6 @@ concurrency: cancel-in-progress: true jobs: - setup_matrix: runs-on: ubuntu-24.04 outputs: @@ -40,7 +39,6 @@ jobs: IMAGE_TAG: apache/superset:GHA-${{ matrix.build_preset }}-${{ github.run_id }} steps: - - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )" uses: actions/checkout@v6 with: @@ -91,7 +89,7 @@ jobs: # in the context of push (using multi-platform build), we need to pull the image locally - name: Docker pull if: github.event_name == 'push' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) - run: docker pull $IMAGE_TAG + run: docker pull $IMAGE_TAG - name: Print docker stats if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker @@ -101,23 +99,6 @@ jobs: docker images $IMAGE_TAG docker history $IMAGE_TAG - # Scan for vulnerabilities in built container image after pushes to mainline branch. - - name: Run Trivy container image vulnerabity scan - if: github.event_name == 'push' && github.ref == 'refs/heads/master' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'lean' - uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2 - with: - image-ref: ${{ env.IMAGE_TAG }} - format: 'sarif' - output: 'trivy-results.sarif' - vuln-type: 'os' - severity: 'CRITICAL,HIGH' - ignore-unfixed: true - - name: Upload Trivy scan results to GitHub Security tab - if: github.event_name == 'push' && github.ref == 'refs/heads/master' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'lean' - uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8 - with: - sarif_file: 'trivy-results.sarif' - - name: docker-compose sanity check if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'dev' shell: bash