Circleci: Update nightly trivy scan #930
Conversation
| - run: | ||
| name: Scan with trivy | ||
| shell: /bin/sh | ||
| command: | | ||
| rm -rf docker/test* | ||
| for FILE in $(ls docker) |
There was a problem hiding this comment.
What were the previous values of $FILE?
There was a problem hiding this comment.
we used to have docker/jdk17/Dockerfile and docker/jdk11/Dockerfile. Hence we used to create/publish consensys/web3signer:develop-java11 and consensys/web3signer:develop-java17. Since we now default to java17 variant, the develop tag now points to develop-java17. In addition, we further publish platform specific variants as well i.e. develop-amd64 and develop-arm64. Similarly, develop-java17-amd64 and develop-java17-arm64
In summary, we only need to test/scan develop tag unless we introduce java21 tag along with java17 tag. We were also only scanning develop-amd64 variant in past as CircleCI trivy job runs on Linux amd64 environment. Now we make sure to scan both amd64 and arm64 variants (as both of them are built separately).
PR Description
Update CircleCI dockerScan (trivy) nightly task. Use circleci base image for more up-to-date tools. Scan both amd64 and arm64 variants of web3signer develop tag.
Fixed Issue(s)
Documentation
doc-change-requiredlabel to this PR if updates are required.Changelog
Testing