Skip to content

Draft: Update trivy to version 0.42.1 (DO-NOT-MERGE)

Container Security Bot requested to merge update-trivy-to-0.42.1-2023-06-16 into master

Why is this change being made?

NOTE: THIS MR CONTAINS A BREAKING CHANGE AND SHOULD NOT BE MERGED UNTIL Add workaround in Container Scanning to allow u... (gitlab-org/gitlab#404587 - closed) HAS BEEN COMPLETED!

We're updating trivy to the newest available version (0.42.1).

Please follow these steps to release the new version:

  1. Retrieve the image url from the pipeline job log:

    • The job should have the title: release > tag branch:[trivy, Dockerfile]
    • Look for the image url from the logs. It should look something like: registry.gitlab.com/gitlab-org/security-products/analyzers/container-scanning/tmp/grype:193dca72bab3627976c62f4b6d3e7ccb438a7f5c
  2. Run a container scan using the image url

    You can reference this Container Scanning Test repo to run a container scan.

    1. Run a new pipeline
    2. Set a ci variable CS_ANALYZER_IMAGE with the image url obtained from step 1
    3. Check that the container scan completes without error.
  3. Check the changelog of Trivy and Grype to see if there are any potential breaking change that might affect the code.

  4. Ensure Integration tests are passing

  5. If all is good, merge this MR.

  6. Create a new tag based on the new version that should have been auto incremented.

    • The new version can be found in the version.rb file.
  7. A release pipeline would be triggered to release the new version.

Edited by Adam Cohen

Merge request reports