This pull request includes several updates to the.github/workflows/cve-scan.yaml file to enhance the security scanning process and update dependencies.

Workflow Enhancements:

Addedworkflow_dispatch to allow manual triggering of the workflow.
Addedpermissions to specify read access to contents and write access to security events.

Dependency Updates:

Updatedactions/checkout from v3 to v4.
Updateddocker/setup-qemu-action from v2 to v3.
Updateddocker/setup-buildx-action from v2 to v3.
Updatedanchore/scan-action from v3 to v5.
Updatedgithub/codeql-action/upload-sarif from v2 to v3.
Updatederzz/dockle-action from v1.3.2 to v1.

Configuration Changes:

Added steps to login to GitHub Container Registry and configure Trivy for enhanced security scanning.
Unified the image name definition to useIMAGE_NAME environment variable across all steps.[1][2][3]
Added environment variables to Trivy configuration to skip Java DB updates and disable VEX notices.

chore: update dependencies, authenticate docker hub

7650f80

github-actionsbot added the Needs Triage label

Nov 9, 2024

ory-bot assignedtricky42

Nov 9, 2024

tricky42 added6 commits

November 9, 2024 16:12

chore: removing the need to adjust the GHA per Opensource Repo

dea1679

chore: debug

c671fb2

chore: add hydra special case for tag name

bfe5c90

chore: add hydra special case for tag name

ccb7f43

chore: fix

53f5145

chore: format

6440441

Copy link

ContributorAuthor

If there are no inconsistencies (like in the Hydra image tag case), this script version should work in all OpenSource repos for our services (Kratos, Oathkeeper, Keto, Hydra). I will check this; then, we could place it inory/meta and sync it, or?