Skip to content

Disable trivy #7422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nvuillam merged 1 commit into from
Mar 23, 2026
+112 −403
Merged

Disable trivy #7422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions .automation/generated/linters_matrix.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,6 @@
"repository_secretlint",
"repository_semgrep",
"repository_syft",
"repository_trivy",
"repository_trivy_sbom",
"repository_trufflehog",
"repository_kingfisher",
"robotframework_robocop",
Expand Down
26 changes: 13 additions & 13 deletions .github/workflows/deploy-ALPHA-flavors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,16 +138,16 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: ghcr.io/oxsecurity/megalinter-${{ matrix.flavor }}:alpha
format: 'table'
exit-code: '1'
ignore-unfixed: true
scanners: vuln
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: 10m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: ghcr.io/oxsecurity/megalinter-${{ matrix.flavor }}:alpha
# format: 'table'
# exit-code: '1'
# ignore-unfixed: true
# scanners: vuln
# vuln-type: 'os,library'
# severity: 'CRITICAL,HIGH'
# timeout: 10m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26 changes: 13 additions & 13 deletions .github/workflows/deploy-BETA-flavors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,16 +210,16 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0]}}"
format: "table"
exit-code: "1"
ignore-unfixed: true
scanners: vuln
vuln-type: "os,library"
severity: "CRITICAL,HIGH"
timeout: 10m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0]}}"
# format: "table"
# exit-code: "1"
# ignore-unfixed: true
# scanners: vuln
# vuln-type: "os,library"
# severity: "CRITICAL,HIGH"
# timeout: 10m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26 changes: 13 additions & 13 deletions .github/workflows/deploy-BETA-linters.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,16 +163,16 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0]}}"
format: "table"
exit-code: "1"
ignore-unfixed: true
scanners: vuln
vuln-type: "os,library"
severity: "CRITICAL,HIGH"
timeout: 10m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0]}}"
# format: "table"
# exit-code: "1"
# ignore-unfixed: true
# scanners: vuln
# vuln-type: "os,library"
# severity: "CRITICAL,HIGH"
# timeout: 10m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26 changes: 13 additions & 13 deletions .github/workflows/deploy-BETA.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,19 +241,19 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "${{ steps.meta.outputs.tags }}"
format: 'table'
exit-code: '1'
ignore-unfixed: true
scanners: vuln
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: 15m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: "${{ steps.meta.outputs.tags }}"
# format: 'table'
# exit-code: '1'
# ignore-unfixed: true
# scanners: vuln
# vuln-type: 'os,library'
# severity: 'CRITICAL,HIGH'
# timeout: 15m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}

build-custom-flavor-builder:
strategy:
Expand Down
26 changes: 13 additions & 13 deletions .github/workflows/deploy-DEV-linters.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,16 +149,16 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0] }}"
format: "table"
exit-code: "1"
ignore-unfixed: true
scanners: vuln
vuln-type: "os,library"
severity: "CRITICAL,HIGH"
timeout: 10m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0] }}"
# format: "table"
# exit-code: "1"
# ignore-unfixed: true
# scanners: vuln
# vuln-type: "os,library"
# severity: "CRITICAL,HIGH"
# timeout: 10m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26 changes: 13 additions & 13 deletions .github/workflows/deploy-RELEASE-flavors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,16 +180,16 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'ghcr.io/oxsecurity/megalinter-${{ matrix.flavor }}:${{ github.event.release.tag_name }}'
format: 'table'
exit-code: '1'
ignore-unfixed: true
scanners: vuln
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: 10m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: 'ghcr.io/oxsecurity/megalinter-${{ matrix.flavor }}:${{ github.event.release.tag_name }}'
# format: 'table'
# exit-code: '1'
# ignore-unfixed: true
# scanners: vuln
# vuln-type: 'os,library'
# severity: 'CRITICAL,HIGH'
# timeout: 10m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26 changes: 13 additions & 13 deletions .github/workflows/deploy-RELEASE-linters.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,16 +140,16 @@ jobs:
##############################################
# Check Docker image security with Trivy #
##############################################
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: ghcr.io/oxsecurity/megalinter-only-${{ matrix.linter }}:${{ github.event.release.tag_name }}
format: 'table'
exit-code: '1'
ignore-unfixed: true
scanners: vuln
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: 10m0s
env:
ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: ghcr.io/oxsecurity/megalinter-only-${{ matrix.linter }}:${{ github.event.release.tag_name }}
# format: 'table'
# exit-code: '1'
# ignore-unfixed: true
# scanners: vuln
# vuln-type: 'os,library'
# severity: 'CRITICAL,HIGH'
# timeout: 10m0s
# env:
# ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2 changes: 2 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,8 @@ GHSA-qffp-2rhf-9h96
CVE-2026-29786
# https://avd.aquasec.com/nvd/2026/cve-2026-29786/: Docker for windows, this issue does not impact non-Windows binaries
CVE-2025-15558
# https://avd.aquasec.com/nvd/cve-2026-30922 : pyasn1, DDOS attack risk, not applicable in MegaLinter context
CVE-2026-30922
# Dockerfile
DS001
DS-0001
Expand Down
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
- New linters

- Disabled linters
- Disable trivy until their security issue is solved

- Deprecated linters

Expand All @@ -31,6 +32,7 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
- Doc

- CI
- Disable trivy-action until their security issue is solved

- mega-linter-runner

Expand Down
12 changes: 0 additions & 12 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,10 +322,6 @@ ARG NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION=11.3.1
ARG PIP_SEMGREP_VERSION=1.155.0
# renovate: datasource=github-tags depName=anchore/syft
ARG REPOSITORY_SYFT_VERSION=1.42.2
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_VERSION=0.69.3
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_SBOM_VERSION=0.69.3
# renovate: datasource=github-tags depName=mongodb/kingfisher
ARG REPOSITORY_KINGFISHER_VERSION=1.88.0
# renovate: datasource=pypi depName=robotframework-robocop
Expand Down Expand Up @@ -1199,14 +1195,6 @@ ENV KICS_QUERIES_PATH=/usr/bin/assets/queries KICS_LIBRARIES_PATH=/usr/bin/asset
# syft installation
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin \
#
# trivy installation
&& wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_VERSION}" \
&& (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress) \
#
# trivy-sbom installation
&& wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_SBOM_VERSION}" \
&& (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress) \
#
# trufflehog installation
# Managed with COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
#
Expand Down
15 changes: 1 addition & 14 deletions flavors/c_cpp/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,10 +157,6 @@ ARG NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION=11.3.1
ARG PIP_SEMGREP_VERSION=1.155.0
# renovate: datasource=github-tags depName=anchore/syft
ARG REPOSITORY_SYFT_VERSION=1.42.2
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_VERSION=0.69.3
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_SBOM_VERSION=0.69.3
# renovate: datasource=pypi depName=snakemake
ARG PIP_SNAKEMAKE_VERSION=9.16.3
# renovate: datasource=pypi depName=snakefmt
Expand Down Expand Up @@ -500,16 +496,7 @@ RUN curl --retry 5 --retry-delay 5 -sSLO https://github.com/pinterest/ktlint/rel
# semgrep installation
#
# syft installation
&& curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin \
#
# trivy installation
&& wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_VERSION}" \
&& (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress) \
#
# trivy-sbom installation
&& wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_SBOM_VERSION}" \
&& (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress)

&& curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin
#
# trufflehog installation
# Managed with COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
Expand Down
2 changes: 0 additions & 2 deletions flavors/c_cpp/flavor.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,8 +47,6 @@
"REPOSITORY_SECRETLINT",
"REPOSITORY_SEMGREP",
"REPOSITORY_SYFT",
"REPOSITORY_TRIVY",
"REPOSITORY_TRIVY_SBOM",
"REPOSITORY_TRUFFLEHOG",
"SNAKEMAKE_LINT",
"SNAKEMAKE_SNAKEFMT",
Expand Down
15 changes: 1 addition & 14 deletions flavors/ci_light/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,10 +94,6 @@ ARG NPM_SECRETLINT_SECRETLINT_RULE_PRESET_RECOMMEND_VERSION=11.3.1
ARG NPM_SECRETLINT_SECRETLINT_FORMATTER_SARIF_VERSION=11.3.1
# renovate: datasource=github-tags depName=anchore/syft
ARG REPOSITORY_SYFT_VERSION=1.42.2
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_VERSION=0.69.3
# renovate: datasource=github-tags depName=aquasecurity/trivy
ARG REPOSITORY_TRIVY_SBOM_VERSION=0.69.3
# renovate: datasource=pypi depName=yamllint
ARG PIP_YAMLLINT_VERSION=1.38.0
# renovate: datasource=pypi depName=pip
Expand Down Expand Up @@ -284,16 +280,7 @@ RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/refs/tags/v${REPO
# secretlint installation
#
# syft installation
&& curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin \
#
# trivy installation
&& wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_VERSION}" \
&& (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress) \
#
# trivy-sbom installation
&& wget --tries=5 -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "v${REPOSITORY_TRIVY_SBOM_VERSION}" \
&& (trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress || trivy image --download-db-only --no-progress)

&& curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOSITORY_SYFT_VERSION}/install.sh | sh -s -- -b /usr/local/bin
#
# trufflehog installation
# Managed with COPY --link --from=trufflehog /usr/bin/trufflehog /usr/bin/
Expand Down
Loading
Loading