Re: [I] Github workflow for scanning CVEs [spark]

["zhangxinyao88 (via GitHub)" <gi...@apache.org>]

zhangxinyao88 commented on issue #58290:
URL: https://github.com/apache/spark/issues/58290#issuecomment-5564378365

   Thanks for the Iceberg reference — I’d like to take this.
   
   To keep an initial implementation useful but bounded, would it make sense to scan a representative Spark binary distribution / bundled JAR set rather than the full release matrix?
   
   My proposed first scope is:
   - a read-only workflow, with pinned actions;
   - HIGH/CRITICAL dependency findings only;
   - PR runs fail on findings, while upstream push or scheduled runs report findings for tracking;
   - SARIF upload only on upstream runs, so fork PRs do not require elevated permissions;
   - reviewed ignore files for accepted exceptions.
   
   If that direction matches the maintainers’ expectations, I can put together a focused PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org