apunkt/plano
1
0
Fork 0
mirror of https://github.com/katanemo/plano.git synced 2026-04-30 19:36:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add Trivy Docker security scan to CI (#755)

Browse source 
* Add Trivy Docker image security scan workflow

Scans the Docker image for CRITICAL and HIGH vulnerabilities using Trivy.
Blocks PRs on failures; runs non-blocking on main for visibility. Results
are uploaded to the GitHub Security tab via SARIF.


* Add explicit permissions to Docker security scan workflow

Set minimal permissions: contents read for checkout, security-events
write for SARIF upload to the GitHub Security tab.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix 27 HIGH vulnerabilities found by Trivy Docker scan

- Install supervisor via pip instead of apt to eliminate 22 Debian
  python3.13 package vulnerabilities
- Pin urllib3>=2.6.3 to fix CVE-2025-66418, CVE-2025-66471, CVE-2026-21441
- Add ignore-unfixed to Trivy scan to suppress unfixable glibc CVE-2026-0861

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Adil Hafeez 2026-02-13 19:53:49 -08:00 • committed by GitHub
parent 94f804991e
commit 38646fdac2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 67 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

1
cli/pyproject.toml
View file

@ -14,6 +14,7 @@ dependencies = [
"questionary>=2.1.1,<3.0.0",
"pyyaml>=6.0.2,<7.0.0",
"requests>=2.31.0,<3.0.0",
"urllib3>=2.6.3",
"rich>=14.2.0",
"rich-click>=1.9.5",
]