From cc11e264c659c7c5a2220077bdadbab786fdaac9 Mon Sep 17 00:00:00 2001 From: peet Date: Sun, 30 Aug 2026 19:36:33 +0200 Subject: [PATCH] trivy-fs-scan: enforce by default; 'false' is the emergency escape (#5) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Feedback from the first rollout: a default-off gate is the wrong way around — the default must be active and enforced, with the opt-out as an explicit, documented per-invocation emergency flag (same posture as the image-scan gate). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg Reviewed-on: https://gitea.noctrl.eu/public/actions/pulls/5 Co-authored-by: peet --- README.md | 7 ++++--- trivy-fs-scan/action.yaml | 8 +++++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 3974bf4..dd26dff 100644 --- a/README.md +++ b/README.md @@ -123,9 +123,10 @@ from repo secrets; no-op when the secret is unset (build stays unsigned). ### Trivy Filesystem Scan Scans the checked-out workspace for vulnerable dependencies (lockfile-based) — -for repos that build artifacts (APKs) rather than images. Non-blocking by -default (`enforce: "false"`); requires committed Gradle lockfiles and the -trivy binary on the runner. Pin the job to `linux,build,amd64`. +for repos that build artifacts (APKs) rather than images. Enforcing by default +(fails on fixable HIGH/CRITICAL); `enforce: "false"` is a temporary emergency +escape only. Requires committed Gradle lockfiles and the trivy binary on the +runner. Pin the job to `linux,build,amd64`. **Location:** [`./trivy-fs-scan`](./trivy-fs-scan) diff --git a/trivy-fs-scan/action.yaml b/trivy-fs-scan/action.yaml index c8eaab1..a929076 100644 --- a/trivy-fs-scan/action.yaml +++ b/trivy-fs-scan/action.yaml @@ -18,10 +18,12 @@ inputs: default: HIGH,CRITICAL enforce: description: > - "true" fails the job on findings with an available fix; "false" only - reports them (start non-blocking, flip once the noise level is known). + "true" (the default) fails the job on findings with an available fix. + Set "false" ONLY as a temporary emergency escape (e.g. an urgent fix + must ship while a finding is being addressed) — always with an inline + comment in the workflow explaining why. required: false - default: "false" + default: "true" runs: using: composite