added trivy vunerability scanning to ci pipeline#112
Conversation
📝 WalkthroughWalkthroughAdds a Trivy filesystem vulnerability scan to the phase3-tests GitHub Actions job and updates the services package initializer plus small tracking module import and entrypoint adjustments. ChangesCI Workflow Security Enhancement
Services package and tracking updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/phase3-tests.yml (1)
26-30: ⚡ Quick winConsider adding output configuration and artifact upload.
The scan results are currently only visible in workflow logs. Adding structured output and uploading results as artifacts improves tracking, enables trend analysis, and makes it easier to review findings without re-running the workflow.
📊 Suggested enhancement
- name: Run Trivy Vulnerability Scanner uses: aquasecurity/trivy-action@master with: scan-type: fs scan-ref: . + format: sarif + output: trivy-results.sarif + + - name: Upload Trivy scan results + uses: actions/upload-artifact@v4 + if: always() # Upload even if scan fails + with: + name: trivy-scan-results + path: trivy-results.sarifAlternatively, use
format: tablefor human-readable output orformat: jsonfor programmatic processing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/phase3-tests.yml around lines 26 - 30, Update the "Run Trivy Vulnerability Scanner" step (uses: aquasecurity/trivy-action@master) to emit structured output by adding a format and output file (e.g., set format: json and output: ./trivy-results.json or format: table for human-readable), then add a following job step that uses actions/upload-artifact to upload that output file (e.g., trivy-results.json) as a workflow artifact for later review and trend analysis; ensure the scan-step writes to the specified output path so the upload step can find and attach the artifact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/phase3-tests.yml:
- Around line 26-30: The Trivy step using "uses:
aquasecurity/trivy-action@master" currently sets scan-type and scan-ref but does
not set an exit-code, so the job won't fail on found vulnerabilities; update
that action block to include "exit-code: 1" (and optionally "severity" to
control which severities cause failure) so the workflow fails when
vulnerabilities are detected, ensuring the Trivy scan acts as a security gate.
- Line 27: The workflow currently references the Trivy action using a moving ref
("uses: aquasecurity/trivy-action@master"); change this to a fixed release tag
to make the workflow deterministic (for example replace the "`@master`" ref with a
specific version tag like "`@v0.36.0`" or another vetted release) in the uses line
so CI uses a reproducible action version and reduces
supply-chain/breaking-change risk.
---
Nitpick comments:
In @.github/workflows/phase3-tests.yml:
- Around line 26-30: Update the "Run Trivy Vulnerability Scanner" step (uses:
aquasecurity/trivy-action@master) to emit structured output by adding a format
and output file (e.g., set format: json and output: ./trivy-results.json or
format: table for human-readable), then add a following job step that uses
actions/upload-artifact to upload that output file (e.g., trivy-results.json) as
a workflow artifact for later review and trend analysis; ensure the scan-step
writes to the specified output path so the upload step can find and attach the
artifact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cc11e688-f241-4491-82da-b9684bde78d8
📒 Files selected for processing (1)
.github/workflows/phase3-tests.yml
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
The failing workflow appears to be caused by an existing test/import issue (ModuleNotFoundError: No module named 'Eagle') unrelated to the Trivy integration changes. The Trivy vulnerability scanning workflow has been added successfully to the CI pipeline. |
|
@Devnil434 |
|
I checked the failing Phase 3 CI for this PR. The failure is unrelated to Trivy itself: ests/test_memory.py imports services.memory, but services/init.py eagerly imports tracking, causing the memory-only CI job to load services/tracking/tracker.py and fail on unrelated tracking imports/deps.\n\nI prepared a fix branch here: https://github.com/kunal-9090/Eagle/tree/codex/fix-pr-112-ci\n\nFix included:\n- update services/tracking/tracker.py to use rom libs.config.settings import settings\n- remove eager tracking import from services/init.py so Phase 3 CI stays isolated\n\nLocal verification: python -m ruff check services/memory/ libs/schemas/memory.py services/init.py services/tracking/tracker.py passes. I could not push directly to this contributor fork; GitHub returned 403 for kunal-9090. |
|
@kunal-9090 |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
services/tracking/tracker.py (1)
21-31:⚠️ Potential issue | 🟠 Major | ⚡ Quick winMove repo-root
sys.pathsetup before internal package imports.Line 21 imports
libs...before Line 29 inserts repo root intosys.path, so standalone execution can fail before bootstrap runs.Proposed fix
from __future__ import annotations import argparse import logging import time from pathlib import Path +import sys +# ── adjust sys.path so we can import sibling packages ────────────────────── +sys.path.insert(0, str(Path(__file__).resolve().parents[2])) # repo root + from libs.config.settings import settings import cv2 import numpy as np from deep_sort_realtime.deepsort_tracker import DeepSort -# ── adjust sys.path so we can import sibling packages ────────────────────── -import sys - -sys.path.insert(0, str(Path(__file__).resolve().parents[2])) # repo root - from libs.schemas.detection import DetectionFrameSchema🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/tracking/tracker.py` around lines 21 - 31, The repo-root sys.path insertion is placed after internal package imports causing import failures when run standalone; move the sys.path.insert(0, str(Path(__file__).resolve().parents[2])) line (and any required Path import) to before any imports from the libs package (e.g., before "from libs.config.settings import settings" and "from libs.schemas.detection import DetectionFrameSchema"), so that DeepSort, cv2, numpy can remain but all internal libs imports resolve correctly at module import time..github/workflows/phase3-tests.yml (1)
13-32:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd an explicit least-privilege
permissionsblock for this job.
GITHUB_TOKENcurrently uses default permissions, which are broader than needed. Define minimal permissions (at leastcontents: read) to reduce workflow token blast radius.🔐 Suggested patch
jobs: test: runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@v4🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/phase3-tests.yml around lines 13 - 32, The workflow job "test" currently relies on default GITHUB_TOKEN permissions; add an explicit least-privilege permissions block for that job by inserting a permissions: mapping (e.g., permissions: contents: read) scoped to the test job (or at top-level) so only the minimal permission is granted for actions/checkout and related steps; update the job definition named "test" to include this permissions entry near the top of the job stanza.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/phase3-tests.yml:
- Around line 13-32: The workflow job "test" currently relies on default
GITHUB_TOKEN permissions; add an explicit least-privilege permissions block for
that job by inserting a permissions: mapping (e.g., permissions: contents: read)
scoped to the test job (or at top-level) so only the minimal permission is
granted for actions/checkout and related steps; update the job definition named
"test" to include this permissions entry near the top of the job stanza.
In `@services/tracking/tracker.py`:
- Around line 21-31: The repo-root sys.path insertion is placed after internal
package imports causing import failures when run standalone; move the
sys.path.insert(0, str(Path(__file__).resolve().parents[2])) line (and any
required Path import) to before any imports from the libs package (e.g., before
"from libs.config.settings import settings" and "from libs.schemas.detection
import DetectionFrameSchema"), so that DeepSort, cv2, numpy can remain but all
internal libs imports resolve correctly at module import time.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6e9007b9-4726-4025-8589-91e41ef5a0ac
📒 Files selected for processing (3)
.github/workflows/phase3-tests.ymlservices/__init__.pyservices/tracking/tracker.py
|
@kunal-9090
These seem to originate from recent upstream changes. Please let me know whether you'd like me to prepare a follow-up fix. |
3 participants
Description
Integrated Trivy vulnerability scanning into the GitHub Actions CI workflow.
Changes Made
Benefits
Summary by CodeRabbit