Skip to content

Conversation

@cosmir17
Copy link
Contributor

@cosmir17 cosmir17 commented Dec 1, 2025

Summary

Builds on #70 to add missing environment configurations and update component versions for the Trivy image scanning workflow.

Changes

  • Add GHCR authentication for private image access
  • Add environment configs for node-dev-01, preview, and preprod
  • Sync pc-chain-config.json files from midnight-node repo
  • Update component versions:
    • postgres: 15.3 → 17.2
    • cardano-db-sync: 13.6.0.4 → 13.6.0.5
    • cardano-node: 10.2.1 → 10.5.3
    • testnet-02 node: 0.12.0 → 0.12.1
  • Improve scan.sh error handling with placeholder SARIF for failed scans

@cosmir17 cosmir17 self-assigned this Dec 1, 2025
@cosmir17 cosmir17 requested review from a team as code owners December 1, 2025 23:20
@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Add preview/preprod/node-dev-01 environments with configs from midnight-node, update postgres to 17.2, cardano-db-sync to 13.6.0.5, and sync pc-chain-config files.
@cosmir17 cosmir17 force-pushed the fix-trivy-scan-environments branch from 36b2577 to 71506d3 Compare December 1, 2025 23:31
@cosmir17
Copy link
Contributor Author

cosmir17 commented Dec 1, 2025

Hey @gilescope, made the tweaks you mentioned - added the missing environments and updated the configs. Let me know if you'd like any adjustments and feel free to make any changes and merge this PR to yours 🙏

Copy link
Collaborator

@gilescope gilescope left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really want there to be no secrets. If that means there's some envs we don't scan here then that's acceptable.

Images in compose files (midnight-node, cardano) are publicly accessible.
@cosmir17 cosmir17 force-pushed the fix-trivy-scan-environments branch from 0a28649 to dfd5d0c Compare December 2, 2025 22:06
@cosmir17
Copy link
Contributor Author

cosmir17 commented Dec 2, 2025

@gilescope Good point - verified the images in the compose files (midnight-node, cardano-node, cardano-db-sync, ogmios, postgres) are all publicly accessible. Removed the GHCR login step to keep it fork-friendly.

@cosmir17 cosmir17 requested a review from gilescope December 3, 2025 11:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants