lazy-actions/gitrivy

GitHub Issue + Trivy Action

gitrivy's Issues

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Description	Package Name	Installed Version	Fixed Version	References
undefined	HIGH	CVE-2019-14697	musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
undefined	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Missing CVEs? Only first CVE is shown in the issue.

Hi,

First of, great action! Simple and easy to use.

But when an issue is created, the issue content only contains the first CVE found.
Is this on purpose? I would to have all found CVEs in the issue. ( filtered on score ofcause)

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
undefined	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

cve.Reference is not iteratable

Hi there,

I get the following error when a CVE is found: https://github.com/qdm12/godevcontainer/runs/596875220

Although no error if no CVE is found.

Thanks!

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

CI fails at the 0.5.2 but not 0.4.4

Hi,
I thought it was fixed after the trivy team released 0.5.2 but CI still fails with the following setting.

Any clue what's causing?

Run homoluctus/gitrivy@v2
  with:
    trivy_version: 0.5.2
    token: ***
    image: ****
    ignore_unfixed: true
    severity: HIGH,CRITICAL
    vuln_type: os,library
    issue: true
    issue_title: Security Alert
    issue_label: trivy,vulnerability
  env:
    DOCKER_IMAGE_REPO: *****
    DOCKER_IMAGE_TAG: latest
[@octokit/rest] `const Octokit = require("@octokit/rest")` is deprecated. Use `const { Octokit } = require("@octokit/rest")` instead
Download URL: https://github.com/aquasecurity/trivy/releases/download/v0.5.2/trivy_0.5.2_Linux-64bit.tar.gz
Trivy Command Path: /home/runner/work/****/****/trivy
##[error]Error: Failed vulnerability scan using Trivy.
      stdout: 
      stderr: 
      erorr: undefined
    
    at Trivy.scan (/home/runner/work/_actions/homoluctus/gitrivy/v2/dist/index.js:13844:15)
    at /home/runner/work/_actions/homoluctus/gitrivy/v2/dist/index.js:7114:34
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/_actions/homoluctus/gitrivy/v2/dist/index.js:7077:58)

This is our GHA config

      - name: Scan Vulnerabilities
        uses: homoluctus/gitrivy@v2
        with:
          trivy_version: 0.5.2
          token: ${{ secrets.GITHUB_TOKEN }}
          image: ${{ steps.image-id.outputs.IMAGE_ID }}
          ignore_unfixed: true

cve.References is not iterable

##[error]TypeError: cve.References is not iterable
    at Trivy.parse (/home/runner/work/_actions/homoluctus/gitrivy/v1.0.0/dist/index.js:13352:45)
    at /home/runner/work/_actions/homoluctus/gitrivy/v1.0.0/dist/index.js:6599:40
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/_actions/homoluctus/gitrivy/v1.0.0/dist/index.js:6555:58)
##[error]cve.References is not iterable
##[error]Node run failed with exit code 1

Using it with default options, any idea if I am missing something?

      - name: Build the Docker image
        run: docker build . --file Dockerfile --tag localbuild/testimage:latest
      - uses: homoluctus/[email protected]
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          image: localbuild/testimage:latest

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

  |Title|Severity|CVE|Description|Package Name|Installed Version|Fixed Version|References|
  |:--:|:--:|:--:|:--|:--:|:--:|:--:|:--|
  |undefined|HIGH|CVE-2019-14697|musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.|musl|1.1.22-r2|1.1.22-r3|0<br>1<br><br><br>

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	Description	References
undefined	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
undefined	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Feature: retrieve latest GitHub image tag/release

Would be nice if the Action would fetch the latest version of a docker container from a registry and use that for scanning. Having an automatically deploy process really prevents hardcoding the release version in the Action. latest is a bad practice.

Failure - Node run failed with exit code 1

Thank you for sharing great project.
I've tried gitriny with the following container image but the action ended up with Node run failure.

• Container Image: python:3.4-alpin

• GitHub Action running log:

2020-01-27T13:21:54.4994634Z ##[section]Starting: Request a runner to run this job
2020-01-27T13:21:54.7871803Z Requesting a hosted runner in current repository's account/organization with labels: 'ubuntu-18.04', require runner match: True
2020-01-27T13:21:55.3171886Z Labels matched hosted runners has been found, waiting for one of them get assigned for this job.
2020-01-27T13:21:55.3744625Z ##[section]Finishing: Request a runner to run this job
2020-01-27T13:22:03.9768657Z Current runner version: '2.164.0'
2020-01-27T13:22:03.9769676Z Prepare workflow directory
2020-01-27T13:22:03.9993272Z Prepare all required actions
2020-01-27T13:22:04.0004994Z Download action repository 'homoluctus/[email protected]'
2020-01-27T13:22:06.9668205Z ##[group]Run docker pull ${IMAGE_NAME}
2020-01-27T13:22:06.9668604Z �[36;1mdocker pull ${IMAGE_NAME}�[0m
2020-01-27T13:22:06.9699351Z shell: /bin/bash -e {0}
2020-01-27T13:22:06.9699725Z env:
2020-01-27T13:22:06.9699918Z   IMAGE_NAME: python:3.4-alpine
2020-01-27T13:22:06.9700092Z ##[endgroup]
2020-01-27T13:22:10.8131530Z 3.4-alpine: Pulling from library/python
2020-01-27T13:22:11.1137759Z 8e402f1a9c57: Pulling fs layer
2020-01-27T13:22:11.1144014Z cda9ba2397ef: Pulling fs layer
2020-01-27T13:22:11.1144467Z aafecf9bbbfd: Pulling fs layer
2020-01-27T13:22:11.1144930Z bc2e7e266629: Pulling fs layer
2020-01-27T13:22:11.1145108Z e1977129b756: Pulling fs layer
2020-01-27T13:22:11.1145279Z bc2e7e266629: Waiting
2020-01-27T13:22:11.1145465Z e1977129b756: Waiting
2020-01-27T13:22:11.5266589Z 8e402f1a9c57: Download complete
2020-01-27T13:22:11.5374622Z cda9ba2397ef: Verifying Checksum
2020-01-27T13:22:11.5375959Z cda9ba2397ef: Download complete
2020-01-27T13:22:11.7110265Z aafecf9bbbfd: Verifying Checksum
2020-01-27T13:22:11.7112940Z aafecf9bbbfd: Download complete
2020-01-27T13:22:11.8999902Z 8e402f1a9c57: Pull complete
2020-01-27T13:22:11.9047050Z bc2e7e266629: Verifying Checksum
2020-01-27T13:22:11.9048847Z bc2e7e266629: Download complete
2020-01-27T13:22:11.9563324Z e1977129b756: Verifying Checksum
2020-01-27T13:22:11.9565009Z e1977129b756: Download complete
2020-01-27T13:22:12.1105703Z cda9ba2397ef: Pull complete
2020-01-27T13:22:13.0915180Z aafecf9bbbfd: Pull complete
2020-01-27T13:22:13.2057201Z bc2e7e266629: Pull complete
2020-01-27T13:22:13.4346141Z e1977129b756: Pull complete
2020-01-27T13:22:13.4598025Z Digest: sha256:c210b660e2ea553a7afa23b41a6ed112f85dbce25cbcb567c75dfe05342a4c4b
2020-01-27T13:22:13.4798315Z Status: Downloaded newer image for python:3.4-alpine
2020-01-27T13:22:13.4816420Z docker.io/library/python:3.4-alpine
2020-01-27T13:22:13.5227446Z ##[group]Run homoluctus/[email protected]
2020-01-27T13:22:13.5227579Z with:
2020-01-27T13:22:13.5228186Z   token: ***
2020-01-27T13:22:13.5228284Z   image: ${IMAGE_NAME}
2020-01-27T13:22:13.5228371Z   issue: true
2020-01-27T13:22:13.5228460Z   trivy_version: latest
2020-01-27T13:22:13.5228553Z   severity: HIGH,CRITICAL
2020-01-27T13:22:13.5228642Z   vuln_type: os,library
2020-01-27T13:22:13.5228730Z   ignore_unfixed: false
2020-01-27T13:22:13.5228817Z   issue_title: Security Alert
2020-01-27T13:22:13.5228914Z   issue_label: trivy,vulnerability
2020-01-27T13:22:13.5229001Z env:
2020-01-27T13:22:13.5229091Z   IMAGE_NAME: python:3.4-alpine
2020-01-27T13:22:13.5229179Z ##[endgroup]
2020-01-27T13:22:16.2164812Z Download URL: https://github.com/aquasecurity/trivy/releases/download/v0.4.3/trivy_0.4.3_Linux-64bit.tar.gz
2020-01-27T13:22:17.5238368Z Trivy Command Path: /home/runner/work/actions-sandbox/actions-sandbox/trivy
2020-01-27T13:22:17.5406895Z ##[error]Error: Failed vulnerability scan using Trivy.
      stdout: 
      stderr: 
      erorr: undefined
    
    at Trivy.scan (/home/runner/work/_actions/homoluctus/gitrivy/v1.0.0/dist/index.js:13332:15)
    at /home/runner/work/_actions/homoluctus/gitrivy/v1.0.0/dist/index.js:6592:34
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/_actions/homoluctus/gitrivy/v1.0.0/dist/index.js:6555:58)
2020-01-27T13:22:17.5413224Z ##[error]Failed vulnerability scan using Trivy.
      stdout: 
      stderr: 
      erorr: undefined
    
2020-01-27T13:22:17.5466913Z ##[error]Node run failed with exit code 1
2020-01-27T13:22:17.5477398Z Cleaning up orphan processes

Here is a workflow file:

name: Vulnerability Scan
  push:
    branches:
      - test-trivy-scan
jobs:
  scan:
    name: Daily Vulnerability Scan
    runs-on: ubuntu-18.04
    env:
      IMAGE_NAME: python:3.4-alpine
    steps:
      - name: Pull docker image
        run: docker pull ${IMAGE_NAME}
      - uses: homoluctus/[email protected]
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          image: ${IMAGE_NAME}
          issue: 'true'

I actually tried with a different container image, but I go the same result.

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	Description	References
undefined	HIGH	CVE-2019-14697	musl	1.1.22-r2	musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://www.openwall.com/lists/musl/2019/08/06/1

Security Alert Test

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
N/A	HIGH	CVE-2019-14697	musl	1.1.22-r2	1.1.22-r3	http://www.openwall.com/lists/oss-security/2019/08/06/4 https://security.gentoo.org/glsa/202003-13 https://www.openwall.com/lists/musl/2019/08/06/1

Duplicate issues

It seems like using crontab for this action will cause duplicate issues that are just identical to each other - is there some way to prevent that?

Security Alert

alpine:3.10.1 (alpine 3.10.1)

Title	Severity	CVE	Description	Package Name	Installed Version	Fixed Version	References
undefined	HIGH	CVE-2019-14697	musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.	musl	1.1.22-r2	1.1.22-r3	0 1

SyntaxError: Unexpected end of JSON input

Hi guys,

Hope you are all well !

I tried gitrivy in a workflow but it triggers the following error:

Run homoluctus/gitrivy@master
[@octokit/rest] `const Octokit = require("@octokit/rest")` is deprecated. Use `const { Octokit } = require("@octokit/rest")` instead
Download URL: https://github.com/aquasecurity/trivy/releases/download/v0.14.0/trivy_0.14.0_Linux-64bit.tar.gz
Trivy Command Path: /home/runner/work/prestashop-docker/prestashop-docker/trivy
Error: SyntaxError: Unexpected end of JSON input
    at JSON.parse (<anonymous>)
    at Trivy.scan (/home/runner/work/_actions/homoluctus/gitrivy/master/dist/index.js:13839:69)
    at /home/runner/work/_actions/homoluctus/gitrivy/master/dist/index.js:7114:34
    at Generator.next (<anonymous>)
    at fulfilled (/home/runner/work/_actions/homoluctus/gitrivy/master/dist/index.js:7077:58)
Error: Unexpected end of JSON input

Here is my workflow https://github.com/lucmichalski/prestashop-docker/blob/docker-trivy/.github/workflows/security.yml

Any chance or ideas how to sort it out ?

Cheers,
Luc Michalski

proposal: Create stable major version tag

Could you create a major version tag like v1?