Add configuration option to disable trivy --offline-scan

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Release notes

Add configuration option to enable / disable offline mode for trivy container scanning.

Problem to solve

I would like for trivy to find java vulnerabilities, which it supports out of the box. However due to #351548 (closed) currently the option --offline-scan appears to be hardcoded.

Proposal

Add a new configuration option to allow controlling the --offline-scan flag for trivy.

Intended users

Unknown

Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/

• Cameron (Compliance Manager)
• Delaney (Development Team Lead)
• Sasha (Software Developer)
• Priyanka (Platform Engineer)
• Sidney (Systems Administrator)
• Sam (Security Analyst)
• Rachel (Release Manager)
• Alex (Security Operations Engineer)
• Eddie (Content Editor)

Feature Usage Metrics

See also gitlab-org/security-products/analyzers/container-scanning@70aad4db