Add trivy vulnerability to build - #1828
Conversation
Add `keep-structure` setting to migration wizard
WalkthroughThis PR adds a Trivy filesystem vulnerability scan job to the CI compile workflow along with a ChangesSecurity Scanning and Dependency Updates
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/compile.yml:
- Around line 119-120: The Checkout step in the workflow currently uses
actions/checkout@v4 without disabling credential persistence, which leaves the
GITHUB_TOKEN available to later steps like trivy-action. Update the checkout
configuration to set persist-credentials to false on the Checkout step so the
token is not stored on disk for the rest of the job.
- Around line 122-123: The Trivy workflow step is using a mutable tag for
aquasecurity/trivy-action instead of a pinned commit. Update the uses reference
in the Run Trivy vulnerability scanner step to the v0.35.0 commit SHA
57a97c7e7821a5776cebc9bb87c984fa69cba8f1, keeping the existing job name and step
structure unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6e26039d-e2b5-4422-892a-5b2af78003bf
⛔ Files ignored due to path filters (1)
common/config/rush/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.github/workflows/compile.yml.trivyignorecommon/config/rush/pnpm-config.jsonwi/webview-giga-bridge/package.jsonwi/wi-extension/package.json
| - name: Checkout | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on checkout.
The checkout step doesn't disable credential persistence, leaving the GITHUB_TOKEN on disk for the remainder of the job — including the third-party trivy-action step that follows. Given this exact action has previously been compromised to exfiltrate CI secrets (see the March 2026 trivy-action supply-chain incident), minimizing token exposure here is worthwhile.
🔒 Proposed fix
- name: Checkout
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 119-120: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/compile.yml around lines 119 - 120, The Checkout step in
the workflow currently uses actions/checkout@v4 without disabling credential
persistence, which leaves the GITHUB_TOKEN available to later steps like
trivy-action. Update the checkout configuration to set persist-credentials to
false on the Checkout step so the token is not stored on disk for the rest of
the job.
Source: Linters/SAST tools
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@0.35.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow lines around the referenced action.
sed -n '110,130p' .github/workflows/compile.yml
# Resolve the tag and the proposed commit for aquasecurity/trivy-action v0.35.0.
if command -v gh >/dev/null 2>&1; then
echo "--- tag ref ---"
gh api repos/aquasecurity/trivy-action/git/refs/tags/0.35.0 --jq '{ref:.ref, type:.object.type, sha:.object.sha}'
echo "--- tag object (if annotated) ---"
TAG_OBJ_SHA="$(gh api repos/aquasecurity/trivy-action/git/refs/tags/0.35.0 --jq '.object.sha')"
TAG_TYPE="$(gh api repos/aquasecurity/trivy-action/git/refs/tags/0.35.0 --jq '.object.type')"
if [ "$TAG_TYPE" = "tag" ]; then
gh api repos/aquasecurity/trivy-action/git/tags/"$TAG_OBJ_SHA" --jq '{tag:.tag, type:.object.type, commit:.object.sha}'
fi
echo "--- proposed commit existence ---"
gh api repos/aquasecurity/trivy-action/commits/57a97c7e7821a5776cebc9bb87c984fa69cba8f1 --jq '.sha'
else
echo "gh CLI not available; unable to query GitHub API."
fiRepository: wso2/product-integrator
Length of output: 1321
🌐 Web query:
aquasecurity/trivy-action 0.35.0 commit SHA release notes
💡 Result:
The commit SHA for aquasecurity/trivy-action version 0.35.0 (also released as v0.35.0) is 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 [1][2]. The release, published in March 2026, was issued as part of a security response to a supply chain attack that affected mutable branches (such as @master) of the repository [3][4][1]. While version 0.35.0 was released initially, the project subsequently adopted a 'v' prefix convention (v0.35.0) for future releases to enhance clarity [3][5]. The project explicitly advised users to pin their GitHub Action workflows to this specific commit SHA to ensure security and prevent the use of compromised mutable tags [1][2].
Citations:
- 1: kosli-dev/labs@231f32a
- 2: security: Update trivy-action to use sha for v0.35.0 kubernetes-sigs/blob-csi-driver#2383
- 3: https://github.com/aquasecurity/trivy-action/releases/tag/v0.35.0
- 4: https://newreleases.io/project/github/aquasecurity/trivy-action/release/v0.35.0
- 5: https://github.com/aquasecurity/trivy-action/releases
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Try to resolve the public tag/commit mapping without GitHub API auth.
git ls-remote --tags https://github.com/aquasecurity/trivy-action.git 'refs/tags/0.35.0' 'refs/tags/v0.35.0' || true
git ls-remote https://github.com/aquasecurity/trivy-action.git 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 || trueRepository: wso2/product-integrator
Length of output: 278
Pin aquasecurity/trivy-action to the commit SHA for v0.35.0.
0.35.0 resolves to 57a97c7e7821a5776cebc9bb87c984fa69cba8f1; use the SHA instead of the mutable tag.
Proposed fix
- uses: aquasecurity/trivy-action@0.35.0
+ uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/compile.yml around lines 122 - 123, The Trivy workflow
step is using a mutable tag for aquasecurity/trivy-action instead of a pinned
commit. Update the uses reference in the Run Trivy vulnerability scanner step to
the v0.35.0 commit SHA 57a97c7e7821a5776cebc9bb87c984fa69cba8f1, keeping the
existing job name and step structure unchanged.
| timeout: '10m' | ||
| # lib/vscode and external are third-party submodules (upstream VS Code and | ||
| # wso2/vscode-extensions) maintained and scanned in their own repos. | ||
| skip-dirs: 'common/temp,lib/vscode,external' |
There was a problem hiding this comment.
We can't skip the vulnerabilities on the VS Code side since it's the core of the application.
|
Discussed with @kaumini offline and decided to push this in a future release |
4 participants
Purpose
Resolves https://github.com/wso2-enterprise/integration-engineering/issues/1878
Goals
Approach
User stories
Release note
Documentation
Training
Certification
Marketing
Automation tests
Security checks
Samples
Related PRs
Migrations (if applicable)
Test environment
Learning
Summary by CodeRabbit