You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Retry Trivy install and DB download in release scans - #1075
Release scans have been failing when trivy-action's installer cannot reach get.trivy.dev (curl exit 6 or 7), since it downloads with a single curl and no retries. This installs a pinned Trivy from GitHub releases with a verified checksum and pre-downloads the vulnerability DB, retrying both with exponential backoff, and then runs trivy-action with its own installer, cache, and DB update turned off. A new path-filtered Trivy Setup workflow tests the script and runs real scans on amd64 and arm64, since release scans only run on tags. The local TRIVY_VERSION in the Makefile now matches CI.
Installs a pinned Trivy release from GitHub releases with a verified
SHA-256 and pre-downloads the vulnerability DB, retrying both with
exponential backoff. trivy-action's installer downloads from
get.trivy.dev with a single curl and no retries, so one DNS or connect
failure fails the release.
Wraps trivy-action so Trivy and its DB come from setup-trivy.sh, with
trivy-action's own installer, cache, and DB update disabled. The
Trivy Setup workflow runs the script tests and scans on amd64 and arm64
whenever the setup changes, since release scans only run on tags.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The independent scan can reuse state from the first call, masking setup or scanner failures in the second composite call and leaving repeated-call behavior unverified.
Improves release-scan reliability by replacing Trivy’s built-in installation with a checksum-verified setup script that retries binary and vulnerability database downloads.
Changes:
Adds a shared scanning action and migrates release scans to it.
Adds offline script tests and real-scan checks on amd64 and arm64.
Aligns the local Trivy version with CI at 0.70.0.
File
Description
Makefile
Updates the default Trivy version and its documentation.
hack/scripts/setup-trivy.sh
Installs pinned Trivy and downloads its database with retries.
hack/scripts/setup-trivy_test.sh
Tests setup, retries, checksum validation, and environment exports.
.github/workflows/trivy-setup.yaml
Runs script tests and cross-architecture scan checks.
.github/workflows/release.yaml
Routes release scans through the shared action.
.github/actions/trivy-scan/action.yaml
Combines retry-enabled setup with configured Trivy scans.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
The initial retry delay is not capped by SETUP_TRIVY_MAX_BACKOFF, so lowering the configured maximum below the default delay still allows the first sleep to exceed the documented limit.
Clamp the initial retry delay to the configured maximum backoff
hack/scripts/setup-trivy.sh:83
If SETUP_TRIVY_MAX_BACKOFF is lowered below the initial backoff, the first retry still exceeds that limit. For example, setting only SETUP_TRIVY_MAX_BACKOFF=2 still causes a 10-second first sleep, since the cap is applied only after sleeping at lines 96-101. Clamp the initial delay too so the documented upper bound applies to every retry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release scans have been failing when trivy-action's installer cannot reach get.trivy.dev (curl exit 6 or 7), since it downloads with a single curl and no retries. This installs a pinned Trivy from GitHub releases with a verified checksum and pre-downloads the vulnerability DB, retrying both with exponential backoff, and then runs trivy-action with its own installer, cache, and DB update turned off. A new path-filtered Trivy Setup workflow tests the script and runs real scans on amd64 and arm64, since release scans only run on tags. The local TRIVY_VERSION in the Makefile now matches CI.