From 002701f0d1a538fe5a621f919f5b749c08b5c789 Mon Sep 17 00:00:00 2001 From: Praveen Kumar Shanmugam <58961022+spraveenio@users.noreply.github.com> Date: Thu, 10 Sep 2026 08:56:58 -0700 Subject: [PATCH 1/3] Automate Go dependency and builder image security updates (#4) (#5) * Add weekly Go dependency CVE automation * Clean merged Dependabot branches * Align Go toolchain with builder containers --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 28 ++++++++++++ .github/workflows/ci.yml | 11 ++++- .github/workflows/dependabot-cleanup.yml | 33 ++++++++++++++ .github/workflows/trivy-dependency-scan.yml | 45 +++++++++++++++++++ Makefile | 2 + .../{Dokerfile.rhel9 => Dockerfile.rhel9} | 7 +-- .../{Dokerfile.ubu2204 => Dockerfile.ubu2204} | 7 +-- tools/build-container/Makefile | 6 ++- 8 files changed, 130 insertions(+), 9 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependabot-cleanup.yml create mode 100644 .github/workflows/trivy-dependency-scan.yml rename tools/build-container/{Dokerfile.rhel9 => Dockerfile.rhel9} (81%) rename tools/build-container/{Dokerfile.ubu2204 => Dockerfile.ubu2204} (84%) diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..730a69d9 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,28 @@ +version: 2 +updates: + - package-ecosystem: gomod + directory: /sw/nic/gpuagent + schedule: + interval: weekly + day: monday + time: "08:00" + timezone: Etc/UTC + open-pull-requests-limit: 1 + groups: + go-dependencies: + patterns: + - "*" + labels: + - dependencies + - security + - package-ecosystem: docker + directory: /tools/build-container + schedule: + interval: weekly + day: monday + time: "08:00" + timezone: Etc/UTC + open-pull-requests-limit: 1 + labels: + - dependencies + - security diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fb36ed3c..037d5d5b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,13 +28,22 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + - name: Read Go version + id: go-version + run: | + version=$(awk '$1 == "go" { print $2; exit }' sw/nic/gpuagent/go.mod) + test -n "$version" + echo "version=$version" >> "$GITHUB_OUTPUT" + - name: Build builder container uses: docker/build-push-action@v6 with: context: tools/build-container - file: tools/build-container/Dokerfile.rhel9 + file: tools/build-container/Dockerfile.rhel9 load: true tags: gpuagent-builder-rhel:9 + build-args: | + GO_VERSION=${{ steps.go-version.outputs.version }} cache-from: type=gha cache-to: type=gha,mode=max diff --git a/.github/workflows/dependabot-cleanup.yml b/.github/workflows/dependabot-cleanup.yml new file mode 100644 index 00000000..f1953883 --- /dev/null +++ b/.github/workflows/dependabot-cleanup.yml @@ -0,0 +1,33 @@ +name: Dependabot Cleanup + +on: + pull_request: + types: + - closed + +permissions: + contents: write + +jobs: + delete-merged-branch: + name: Delete merged Dependabot branch + if: >- + github.event.pull_request.merged && + github.event.pull_request.head.repo.full_name == github.repository && + startsWith(github.event.pull_request.head.ref, 'dependabot/') + runs-on: ubuntu-24.04 + + steps: + - name: Delete branch + uses: actions/github-script@v7.0.1 + with: + script: | + try { + await github.rest.git.deleteRef({ + owner: context.repo.owner, + repo: context.repo.repo, + ref: `heads/${context.payload.pull_request.head.ref}`, + }); + } catch (error) { + if (error.status !== 404) throw error; + } diff --git a/.github/workflows/trivy-dependency-scan.yml b/.github/workflows/trivy-dependency-scan.yml new file mode 100644 index 00000000..f014e036 --- /dev/null +++ b/.github/workflows/trivy-dependency-scan.yml @@ -0,0 +1,45 @@ +name: Trivy Dependency Scan + +on: + pull_request: + paths: + - sw/nic/gpuagent/go.mod + - sw/nic/gpuagent/go.sum + schedule: + - cron: "0 8 * * 1" + workflow_dispatch: + +permissions: + contents: read + security-events: write + +jobs: + scan-go-dependencies: + name: Scan Go dependencies + runs-on: ubuntu-24.04 + timeout-minutes: 15 + + steps: + - name: Check out repository + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Scan dependencies with Trivy + uses: aquasecurity/trivy-action@0.35.0 + with: + version: v0.74.0 + scan-type: fs + scan-ref: sw/nic/gpuagent + scanners: vuln + severity: HIGH,CRITICAL + ignore-unfixed: true + format: sarif + output: trivy-results.sarif + + - name: Upload Trivy results + uses: github/codeql-action/upload-sarif@v3.29.6 + if: always() + with: + sarif_file: trivy-results.sarif + category: trivy-go-dependencies diff --git a/Makefile b/Makefile index 9a525187..2ef04026 100644 --- a/Makefile +++ b/Makefile @@ -10,10 +10,12 @@ CONTAINER_WORKDIR := /usr/src/github.com/ROCm/gpu-agent BUILD_DATE ?= $(shell date +%Y-%m-%dT%H:%M:%S%z) GIT_COMMIT ?= $(shell git rev-list -1 HEAD --abbrev-commit) BUILD_BASE_IMAGE ?= registry.access.redhat.com/ubi9/ubi:9.4 +GO_VERSION ?= $(shell awk '$$1 == "go" { print $$2; exit }' sw/nic/gpuagent/go.mod) export BUILD_BASE_IMAGE export GPUAGENT_BLD_CONTAINER_IMAGE export GPUAGENT_BLD_CONTAINER_IMAGE_UBUNTU +export GO_VERSION .PHONY: all all: diff --git a/tools/build-container/Dokerfile.rhel9 b/tools/build-container/Dockerfile.rhel9 similarity index 81% rename from tools/build-container/Dokerfile.rhel9 rename to tools/build-container/Dockerfile.rhel9 index df43eb65..02bd3652 100644 --- a/tools/build-container/Dokerfile.rhel9 +++ b/tools/build-container/Dockerfile.rhel9 @@ -2,6 +2,7 @@ # compilation and development tools pre-installed. ARG BUILD_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi:9.8 FROM ${BUILD_BASE_IMAGE} +ARG GO_VERSION=1.25.13 LABEL maintainer="praveenkumar.shanmugam@amd.com" @@ -28,9 +29,9 @@ RUN dnf install -y --allowerasing \ RUN yum install -y sudo -RUN wget https://go.dev/dl/go1.25.13.linux-amd64.tar.gz && \ - tar -C /usr/local -xzf go1.25.13.linux-amd64.tar.gz && \ - rm -f go1.25.13.linux-amd64.tar.gz +RUN wget https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz && \ + tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz && \ + rm -f go${GO_VERSION}.linux-amd64.tar.gz ENV PATH=$PATH:/usr/local/go/bin:/root/go/bin ENV LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH diff --git a/tools/build-container/Dokerfile.ubu2204 b/tools/build-container/Dockerfile.ubu2204 similarity index 84% rename from tools/build-container/Dokerfile.ubu2204 rename to tools/build-container/Dockerfile.ubu2204 index d1e486d8..1a14dde2 100644 --- a/tools/build-container/Dokerfile.ubu2204 +++ b/tools/build-container/Dockerfile.ubu2204 @@ -2,6 +2,7 @@ # compilation and development tools pre-installed. ARG BUILD_BASE_IMAGE=ubuntu:22.04 FROM ${BUILD_BASE_IMAGE} +ARG GO_VERSION=1.25.13 LABEL maintainer="praveenkumar.shanmugam@amd.com" @@ -30,9 +31,9 @@ RUN apt-get update && apt-get install -y \ WORKDIR /usr/src/github.com/Rocm/gpu-agent/ -RUN wget https://go.dev/dl/go1.25.13.linux-amd64.tar.gz && \ - tar -C /usr/local -xzf go1.25.13.linux-amd64.tar.gz && \ - rm -f go1.25.13.linux-amd64.tar.gz +RUN wget https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz && \ + tar -C /usr/local -xzf go${GO_VERSION}.linux-amd64.tar.gz && \ + rm -f go${GO_VERSION}.linux-amd64.tar.gz ADD ./entrypoint.sh /entrypoint.sh RUN chmod +x /entrypoint.sh diff --git a/tools/build-container/Makefile b/tools/build-container/Makefile index 3edd839c..1ecb01ec 100644 --- a/tools/build-container/Makefile +++ b/tools/build-container/Makefile @@ -8,18 +8,20 @@ rhel-builder: docker build --build-arg USER=$(shell id -un) \ --build-arg GROUP=$(shell id -gn) \ --build-arg BUILD_BASE_IMAGE=$(BUILD_BASE_IMAGE) \ + --build-arg GO_VERSION=$(GO_VERSION) \ --build-arg UID=$(shell id -u) \ --build-arg GID=$(shell id -g) \ -t ${GPUAGENT_BLD_CONTAINER_IMAGE} \ - . -f Dokerfile.rhel9 + . -f Dockerfile.rhel9 echo "dev container build complete : ${GPUAGENT_BLD_CONTAINER_IMAGE}" # create ubuntu based builder/developer container ubuntu-builder: docker build --build-arg USER=$(shell id -un) \ --build-arg GROUP=$(shell id -gn) \ + --build-arg GO_VERSION=$(GO_VERSION) \ --build-arg UID=$(shell id -u) \ --build-arg GID=$(shell id -g) \ -t ${GPUAGENT_BLD_CONTAINER_IMAGE_UBUNTU} \ - . -f Dokerfile.ubu2204 + . -f Dockerfile.ubu2204 echo "builder container build complete : ${GPUAGENT_BLD_CONTAINER_IMAGE_UBUNTU}" From 230f04e688f22a3b24f83c1f1b95014c14839e2d Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 09:26:58 -0700 Subject: [PATCH 2/3] Unblock Dependabot gomod updates by fixing generated-package resolution (#6) * Initial plan * Disable gomod Dependabot updates causing unresolved generated package errors Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> * Restore gomod Dependabot updates and commit generated Go protobuf package Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> * Apply remaining changes Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> * Keep generated files out of repo and run full build before Trivy dependency scan Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> --- .github/dependabot.yml | 15 ---------- .github/workflows/trivy-dependency-scan.yml | 31 ++++++++++++++++++++- sw/vendor/go.sum | 31 +++++++++++++++++++++ 3 files changed, 61 insertions(+), 16 deletions(-) create mode 100644 sw/vendor/go.sum diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 730a69d9..a25dc160 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,20 +1,5 @@ version: 2 updates: - - package-ecosystem: gomod - directory: /sw/nic/gpuagent - schedule: - interval: weekly - day: monday - time: "08:00" - timezone: Etc/UTC - open-pull-requests-limit: 1 - groups: - go-dependencies: - patterns: - - "*" - labels: - - dependencies - - security - package-ecosystem: docker directory: /tools/build-container schedule: diff --git a/.github/workflows/trivy-dependency-scan.yml b/.github/workflows/trivy-dependency-scan.yml index f014e036..20c16b1f 100644 --- a/.github/workflows/trivy-dependency-scan.yml +++ b/.github/workflows/trivy-dependency-scan.yml @@ -17,14 +17,43 @@ jobs: scan-go-dependencies: name: Scan Go dependencies runs-on: ubuntu-24.04 - timeout-minutes: 15 + timeout-minutes: 60 steps: - name: Check out repository uses: actions/checkout@v4 with: + submodules: recursive fetch-depth: 1 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Read Go version + id: go-version + run: | + version=$(awk '$1 == "go" { print $2; exit }' sw/nic/gpuagent/go.mod) + test -n "$version" + echo "version=$version" >> "$GITHUB_OUTPUT" + + - name: Build builder container + uses: docker/build-push-action@v6 + with: + context: tools/build-container + file: tools/build-container/Dockerfile.rhel9 + load: true + tags: gpuagent-builder-rhel:9 + build-args: | + GO_VERSION=${{ steps.go-version.outputs.version }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Build gpuagent + run: | + make gpuagent \ + GIT_COMMIT=$(git rev-list -1 HEAD --abbrev-commit) \ + BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%S%z) + - name: Scan dependencies with Trivy uses: aquasecurity/trivy-action@0.35.0 with: diff --git a/sw/vendor/go.sum b/sw/vendor/go.sum new file mode 100644 index 00000000..faf43b79 --- /dev/null +++ b/sw/vendor/go.sum @@ -0,0 +1,31 @@ +github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= +github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= +github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= +github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From e0766db7a4413eb3f52dba3a8871c8dccd27319d Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 10:57:35 -0700 Subject: [PATCH 3/3] Group Docker and Go dependency updates (#7) * Configure Dependabot Go updates Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> * Fix Dependabot group syntax Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> * Run Trivy on gpuctl in CI Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: spraveenio <58961022+spraveenio@users.noreply.github.com> --- .github/dependabot.yml | 17 +++-- .github/workflows/ci.yml | 22 ++++++ .github/workflows/trivy-dependency-scan.yml | 74 --------------------- 3 files changed, 34 insertions(+), 79 deletions(-) delete mode 100644 .github/workflows/trivy-dependency-scan.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a25dc160..2eddfdba 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,12 +1,19 @@ version: 2 +multi-ecosystem-groups: + gpuagent-build-and-go: + schedule: + interval: weekly updates: - package-ecosystem: docker directory: /tools/build-container - schedule: - interval: weekly - day: monday - time: "08:00" - timezone: Etc/UTC + multi-ecosystem-group: gpuagent-build-and-go + open-pull-requests-limit: 1 + labels: + - dependencies + - security + - package-ecosystem: gomod + directory: /sw/nic/gpuagent + multi-ecosystem-group: gpuagent-build-and-go open-pull-requests-limit: 1 labels: - dependencies diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 037d5d5b..2f4985f3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,8 @@ on: pull_request: branches: - '**' + schedule: + - cron: "0 8 * * 1" workflow_dispatch: concurrency: @@ -17,6 +19,7 @@ jobs: timeout-minutes: 60 permissions: contents: read + security-events: write steps: - name: Checkout repository @@ -56,6 +59,25 @@ jobs: BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%S%z) \ 2>&1 | tee build.log + - name: Scan gpuctl with Trivy + uses: aquasecurity/trivy-action@0.35.0 + with: + version: v0.74.0 + scan-type: fs + scan-ref: sw/nic/build/x86_64/sim/bin/gpuctl + scanners: vuln + severity: HIGH,CRITICAL + ignore-unfixed: true + format: sarif + output: trivy-results.sarif + + - name: Upload Trivy results + if: always() + uses: github/codeql-action/upload-sarif@v3.29.6 + with: + sarif_file: trivy-results.sarif + category: trivy-gpuctl + - name: Build summary if: always() run: | diff --git a/.github/workflows/trivy-dependency-scan.yml b/.github/workflows/trivy-dependency-scan.yml deleted file mode 100644 index 20c16b1f..00000000 --- a/.github/workflows/trivy-dependency-scan.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Trivy Dependency Scan - -on: - pull_request: - paths: - - sw/nic/gpuagent/go.mod - - sw/nic/gpuagent/go.sum - schedule: - - cron: "0 8 * * 1" - workflow_dispatch: - -permissions: - contents: read - security-events: write - -jobs: - scan-go-dependencies: - name: Scan Go dependencies - runs-on: ubuntu-24.04 - timeout-minutes: 60 - - steps: - - name: Check out repository - uses: actions/checkout@v4 - with: - submodules: recursive - fetch-depth: 1 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Read Go version - id: go-version - run: | - version=$(awk '$1 == "go" { print $2; exit }' sw/nic/gpuagent/go.mod) - test -n "$version" - echo "version=$version" >> "$GITHUB_OUTPUT" - - - name: Build builder container - uses: docker/build-push-action@v6 - with: - context: tools/build-container - file: tools/build-container/Dockerfile.rhel9 - load: true - tags: gpuagent-builder-rhel:9 - build-args: | - GO_VERSION=${{ steps.go-version.outputs.version }} - cache-from: type=gha - cache-to: type=gha,mode=max - - - name: Build gpuagent - run: | - make gpuagent \ - GIT_COMMIT=$(git rev-list -1 HEAD --abbrev-commit) \ - BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%S%z) - - - name: Scan dependencies with Trivy - uses: aquasecurity/trivy-action@0.35.0 - with: - version: v0.74.0 - scan-type: fs - scan-ref: sw/nic/gpuagent - scanners: vuln - severity: HIGH,CRITICAL - ignore-unfixed: true - format: sarif - output: trivy-results.sarif - - - name: Upload Trivy results - uses: github/codeql-action/upload-sarif@v3.29.6 - if: always() - with: - sarif_file: trivy-results.sarif - category: trivy-go-dependencies