No High severity security vulnerabilties remain
andytinkham opened this issue · comments
Trivy is currently run as part of the Jenkins build but only fails on Critical severity vulnerabilities. We'd like to tighten this up to fail on High severity vulnerabilities as well. Before changing the Jenkinsfile in master, however, we have to clean up any existing issues, so that we can continue to get passing builds. Then, change Jenkins so the build fails when High severity issues are found.
Current branch from @andytinkham's and mine work on this: https://github.com/cyberark/conjur-service-broker/tree/gems-in-test-dockerfile. This fixes the problems with inclusion of test gems but the build fails in unit test phase because of it.
CC: @izgeri - ping us on Monday and we can rope you in into what's going on here.
After @sgnn7 commented, I tried moving the listen gem back into the main container, which lead to tests passing again. Once the PR build is complete, we should hopefully have confirmation that it wasn't just flapping tests.
Reopening - master build has I think new failures now