You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by mi...@apache.org on 2026/03/23 12:50:00 UTC
(superset) 03/05: fix(sec): remove compromised Trivy actions (#38780)
This is an automated email from the ASF dual-hosted git repository.
michaelsmolina pushed a commit to branch 6.1
in repository https://gitbox.apache.org/repos/asf/superset.git
commit c26d2de616ad69bce11762c364ca3e8abdcc34bd
Author: Đỗ Trọng Hải <41...@users.noreply.github.com>
AuthorDate: Sat Mar 21 12:24:24 2026 +0700
fix(sec): remove compromised Trivy actions (#38780)
Signed-off-by: hainenber <do...@gmail.com>
(cherry picked from commit 7004369c68afa672c70884533d69f788e71e5358)
---
.github/workflows/docker.yml | 21 +--------------------
1 file changed, 1 insertion(+), 20 deletions(-)
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index e17da498eeb..60ff6c3873f 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -14,7 +14,6 @@ concurrency:
cancel-in-progress: true
jobs:
-
setup_matrix:
runs-on: ubuntu-24.04
outputs:
@@ -40,7 +39,6 @@ jobs:
IMAGE_TAG: apache/superset:GHA-${{ matrix.build_preset }}-${{ github.run_id }}
steps:
-
- name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
uses: actions/checkout@v6
with:
@@ -91,7 +89,7 @@ jobs:
# in the context of push (using multi-platform build), we need to pull the image locally
- name: Docker pull
if: github.event_name == 'push' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker)
- run: docker pull $IMAGE_TAG
+ run: docker pull $IMAGE_TAG
- name: Print docker stats
if: steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker
@@ -101,23 +99,6 @@ jobs:
docker images $IMAGE_TAG
docker history $IMAGE_TAG
- # Scan for vulnerabilities in built container image after pushes to mainline branch.
- - name: Run Trivy container image vulnerabity scan
- if: github.event_name == 'push' && github.ref == 'refs/heads/master' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'lean'
- uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # v0.34.2
- with:
- image-ref: ${{ env.IMAGE_TAG }}
- format: 'sarif'
- output: 'trivy-results.sarif'
- vuln-type: 'os'
- severity: 'CRITICAL,HIGH'
- ignore-unfixed: true
- - name: Upload Trivy scan results to GitHub Security tab
- if: github.event_name == 'push' && github.ref == 'refs/heads/master' && (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'lean'
- uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
- with:
- sarif_file: 'trivy-results.sarif'
-
- name: docker-compose sanity check
if: (steps.check.outputs.python || steps.check.outputs.frontend || steps.check.outputs.docker) && matrix.build_preset == 'dev'
shell: bash