TMF/ci-shared
Watch
3
0
Fork
You've already forked ci-shared
 0
Code Pull requests Projects Releases Packages Wiki Activity Actions

chore(trivy): pin tmf-ci-trivy 0.74.0-db20261102-f52ad72 [INFRA-71899] #163

Merged
tmf-ia merged 1 commit from chore/INFRA-71899-pin-trivy-db20261102 into develop 2026-11-03 23:30:01 -03:00
Conversation 0 Commits 1 Files changed 5 +10 -4
tmf-ia commented 2026-11-03 22:43:28 -03:00
Owner
Copy link

O que muda

Pin da tmf-ci-trivy em 0.74.0-db20261102-f52ad72 (DB de 02/11) nos reusables ci.yml, ci-base.yml, reusable-trivy-scan.yml e reusable-image-cve-os.yml, como na INFRA-70797 (#142). O reusable-sbom.yml não muda: ele usa a camada fixa do binário.

Por quê

O gate de CVE falha fechado quando o DB tem mais de 10 dias. A release #1061 do DANI (v3.21.0, run 4526) foi barrada no job gates com DB UpdatedAt 2026-10-22, 13 dias. Isso trava a release de qualquer produto que passe pelo gate.

Prova

docker run --rm --entrypoint trivy .../tmf-ci-trivy:0.74.0-db20261102-f52ad72 version
Version: 0.74.0
Vulnerability DB: UpdatedAt: 2026-11-02 01:14:05 UTC
digest: sha256:39826d49a3829c0aae104c2a0841b51464f72fcbed02592548f7d2d8a85de9ff
python3 -m unittest discover -s tests/cve-os -q      -> OK
python3 -m unittest discover -s tests/pin-actions -q -> OK

Os produtos chamam o ci-shared na @main: o pin só chega a eles com o release develop→main.

INFRA-71899

🤖 Generated with Claude Code

https://claude.ai/code/session_01ES1xwVdpQV69zEsuLLKzx2

## O que muda Pin da `tmf-ci-trivy` em `0.74.0-db20261102-f52ad72` (DB de 02/11) nos reusables `ci.yml`, `ci-base.yml`, `reusable-trivy-scan.yml` e `reusable-image-cve-os.yml`, como na INFRA-70797 (#142). O `reusable-sbom.yml` não muda: ele usa a camada fixa do binário. ## Por quê O gate de CVE falha fechado quando o DB tem mais de 10 dias. A release #1061 do DANI (v3.21.0, run 4526) foi barrada no job gates com DB UpdatedAt 2026-10-22, 13 dias. Isso trava a release de qualquer produto que passe pelo gate. ## Prova ``` docker run --rm --entrypoint trivy .../tmf-ci-trivy:0.74.0-db20261102-f52ad72 version Version: 0.74.0 Vulnerability DB: UpdatedAt: 2026-11-02 01:14:05 UTC digest: sha256:39826d49a3829c0aae104c2a0841b51464f72fcbed02592548f7d2d8a85de9ff python3 -m unittest discover -s tests/cve-os -q -> OK python3 -m unittest discover -s tests/pin-actions -q -> OK ``` Os produtos chamam o ci-shared na `@main`: o pin só chega a eles com o release develop→main. INFRA-71899 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01ES1xwVdpQV69zEsuLLKzx2
chore(trivy): pin tmf-ci-trivy 0.74.0-db20261102-f52ad72 [INFRA-71899]
All checks were successful
PR checks (ci-shared) / testes (pull_request) Successful in 5m5s
Details
ea268e938e 
DB do Trivy de 22/10 passou do limite de 10 dias e o gate de CVE falhou
fechado (release #1061 do DANI). Imagem nova conferida: DB UpdatedAt
2026-11-02 01:14 UTC, digest sha256:39826d49a382.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ES1xwVdpQV69zEsuLLKzx2
tmf-ia merged commit c73f6b0449 into develop 2026-11-03 23:30:01 -03:00
Sign in to join this conversation.
Reviewers
No reviewers
tarcisio
Labels
Clear labels
  
seguranca
Segurança/LGPD — merge só com aprovação do operador

No labels
seguranca
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
TMF/ci-shared!163
No description provided.