github/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-08-25 23:07:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

move trivy image-scan exclusion to the right place

Browse Source
This commit is contained in:
Ryan Richard
2026-03-03 10:14:01 -08:00
parent 55db644832
commit 51e724b6d8
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/pull-requests/pipeline.yml
+8
View File
@@ -15,6 +15,14 @@ meta:
# See https://github.com/kubernetes/kubernetes/issues/128039. So we will ignore this for now.
CVE-2024-28180
# CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we
# get through various k8s modules and through fosite. The CVE description says that it only applies
# to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS,
# so we should have no exposure to this issue. We can wait for the next version of k8s packages to
# update this dependency, if they choose to do so.
# See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0
CVE-2026-24051 exp:2026-06-04
# Save some work by skipping the full download in the implicit "get" after each of these "put" operations,
# as mentioned in the docs here: https://github.com/telia-oss/github-pr-resource#get
pr-status-handlers:
pipelines/shared-tasks/scan-image-trivy/task.yml
+1 -9
View File
@@ -13,15 +13,7 @@ outputs:
params:
GITHUB_TOKEN:
# For format see https://trivy.dev/docs/latest/guide/configuration/filtering/#by-finding-ids
IGNORE_VULNERABILITY_IDS: |
# CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we
# get through various k8s modules and through fosite. The CVE description says that it only applies
# to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS,
# so we should have no exposure to this issue. We can wait for the next version of k8s packages to
# update this dependency, if they choose to do so.
# See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0
CVE-2026-24051 exp:2026-06-04
IGNORE_VULNERABILITY_IDS: ""
run:
path: ash
args: