Skip to content

Trivy CVE scanning to not require cached maven dependencies #736

Description

@Matthbo

Related Problem or Business Case

The data-importer has to run mvn dependency:resolve on every pom in the project.
For the Frank!Framework this would mean that all modules need to go through this, which means all dependencies will be pulled from the frankframework nexus just so Trivy can use the resolved dependencies somehow.

This will be done for every release the framework has on GitHub when running the Insights for the first time, not really optimal.
Issue #735 already asks for having a minimum version limit so it wont scan out of scope releases.

Describe the Feature

Research what the reason is that it has to happen like this.
Maybe Trivy can help us here and do part of the preparation steps, like downloading, unzipping and resolving without the need to have everything be pulled from our nexus

Collaboration with External Companies

No, community resolution only

Anything else?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions