Related Problem or Business Case
The data-importer has to run mvn dependency:resolve on every pom in the project.
For the Frank!Framework this would mean that all modules need to go through this, which means all dependencies will be pulled from the frankframework nexus just so Trivy can use the resolved dependencies somehow.
This will be done for every release the framework has on GitHub when running the Insights for the first time, not really optimal.
Issue #735 already asks for having a minimum version limit so it wont scan out of scope releases.
Describe the Feature
Research what the reason is that it has to happen like this.
Maybe Trivy can help us here and do part of the preparation steps, like downloading, unzipping and resolving without the need to have everything be pulled from our nexus
Collaboration with External Companies
No, community resolution only
Anything else?
No response
Related Problem or Business Case
The data-importer has to run
mvn dependency:resolveon every pom in the project.For the Frank!Framework this would mean that all modules need to go through this, which means all dependencies will be pulled from the frankframework nexus just so Trivy can use the resolved dependencies somehow.
This will be done for every release the framework has on GitHub when running the Insights for the first time, not really optimal.
Issue #735 already asks for having a minimum version limit so it wont scan out of scope releases.
Describe the Feature
Research what the reason is that it has to happen like this.
Maybe Trivy can help us here and do part of the preparation steps, like downloading, unzipping and resolving without the need to have everything be pulled from our nexus
Collaboration with External Companies
No, community resolution only
Anything else?
No response