You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "lhotari (via GitHub)" <gi...@apache.org> on 2026/03/20 16:46:50 UTC
[PR] [fix][ci] Comment out trivy-action until it has been approved by ASF [pulsar]
lhotari opened a new pull request, #25373:
URL: https://github.com/apache/pulsar/pull/25373
## Motivation
The `aquasecurity/trivy-action` repository was compromised in a supply chain attack where an attacker force-pushed malicious payloads to 75 out of 76 version tags. Version 0.35.0 is the first safe release after the incident.
References:
- https://github.com/aquasecurity/trivy-action/issues/541
- https://github.com/aquasecurity/trivy-action/releases/tag/v0.35.0
- https://github.com/aquasecurity/trivy/discussions/10265
## Modifications
Disable `aquasecurity/trivy-action` in the CI workflow. We need to get the action whitelisted by ASF in the https://github.com/apache/infrastructure-actions repository before we can enable it again.
## Documentation
- [x] `doc-not-needed`
## Matching PR in forked repository
_No response_
### Label checklist
- [x] `ready-to-test`
- [x] `area/test`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][ci] Disable trivy-action [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #25373:
URL: https://github.com/apache/pulsar/pull/25373#issuecomment-4099532438
/pulsarbot rerun-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][ci] Disable trivy-action [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #25373:
URL: https://github.com/apache/pulsar/pull/25373
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][ci] Disable trivy-action [pulsar]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #25373:
URL: https://github.com/apache/pulsar/pull/25373#issuecomment-4100297890
## [Codecov](https://app.codecov.io/gh/apache/pulsar/pull/25373?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 72.71%. Comparing base ([`a3ae705`](https://app.codecov.io/gh/apache/pulsar/commit/a3ae70545f3aef40e8f5cfcced907e6500b08894?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`add4aee`](https://app.codecov.io/gh/apache/pulsar/commit/add4aee03ba71808c702922210b9c24fad8d595b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
[](https://app.codecov.io/gh/apache/pulsar/pull/25373?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
```diff
@@ Coverage Diff @@
## master #25373 +/- ##
============================================
+ Coverage 72.52% 72.71% +0.19%
+ Complexity 34275 33863 -412
============================================
Files 1927 1954 +27
Lines 154339 154792 +453
Branches 17683 17731 +48
============================================
+ Hits 111935 112563 +628
+ Misses 33389 33196 -193
- Partials 9015 9033 +18
```
| [Flag](https://app.codecov.io/gh/apache/pulsar/pull/25373/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [inttests](https://app.codecov.io/gh/apache/pulsar/pull/25373/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `25.86% <ø> (-0.18%)` | :arrow_down: |
| [systests](https://app.codecov.io/gh/apache/pulsar/pull/25373/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `22.45% <ø> (?)` | |
| [unittests](https://app.codecov.io/gh/apache/pulsar/pull/25373/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `73.70% <ø> (-0.05%)` | :arrow_down: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
[see 173 files with indirect coverage changes](https://app.codecov.io/gh/apache/pulsar/pull/25373/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [fix][ci] Disable trivy-action [pulsar]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #25373:
URL: https://github.com/apache/pulsar/pull/25373#issuecomment-4099656370
I created https://github.com/apache/infrastructure-actions/pull/546 to allow aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 since we'd like to use it later.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org