Skip to content

Add scan cve job to pipeline - #2835

Open
liamls wants to merge 1 commit into
masterfrom
feature/add_cve_scan_ci
Open

Add scan cve job to pipeline#2835
liamls wants to merge 1 commit into
masterfrom
feature/add_cve_scan_ci

Conversation

@liamls

@liamls liamls commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Add a scan-cve CircleCI job that scans the production image and frontend dependencies with Trivy
  • Produces 3 separate, unambiguous HTML reports (via --vuln-type os|library) instead of one mixed report:
    • env-report.html: OS/Debian CVEs from the python:3.11-bookworm base image
    • back-report.html: back-end (Python/pip) application CVEs only
    • front-report.html: front-end (yarn/npm) application CVEs only
  • Reports are published as CircleCI artifacts, downloadable from the job's "Artifacts" tab
  • Informational only for now: --exit-code 0, the job never fails the pipeline

Test plan

  • Push branch and check the scan-cve job runs on CircleCI
  • Download the 3 artifacts from the job's "Artifacts" tab
  • Confirm each report only lists CVEs matching its scope
  • Confirm the job passes regardless of findings

@liamls
liamls force-pushed the feature/add_cve_scan_ci branch 6 times, most recently from b675f1e to fbaec6b Compare July 28, 2026 15:04
@liamls
liamls requested a review from jonathanreveille July 28, 2026 15:10
@liamls
liamls force-pushed the feature/add_cve_scan_ci branch 3 times, most recently from d9ed33e to 4c0022d Compare July 31, 2026 10:02
@liamls
liamls force-pushed the feature/add_cve_scan_ci branch from b5748b9 to 97d10a1 Compare August 11, 2026 13:22
@liamls
🔧(ci) add scan cve job to pipeline
03ddbef 
We want to add a trivy job
to handle CVE errors and warning
in order to have a global view in a
security context.
@liamls
liamls force-pushed the feature/add_cve_scan_ci branch from 97d10a1 to 03ddbef Compare August 11, 2026 13:54

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jonathanreveille jonathanreveille jonathanreveille approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@liamls @jonathanreveille