Replace the per-image catalogs array with a flat structure: results
are now keyed by (catalog, version), with the same image's scan
counts duplicated across every chart/version that references it.
summary now lists only CRITICAL vulnerabilities, formatted as
"CVE-ID: description" pairs joined by "; ". Description comes from
trivy's Title field, falling back to the first sentence of Description.
Allow scanning a single catalog (manifests/helm/<chart>/) via the
workflow_dispatch chart input, filtering images_final.tsv by chart
name before the limit is applied. Empty value scans the full catalog
as before.
Allow scanning a single catalog (manifests/helm/<chart>/) via the
workflow_dispatch chart input, filtering images_final.tsv by chart
name before the limit is applied. Empty value scans the full catalog
as before.
Parallel trivy image workers sharing the fs cache directory hit
"cache may be in use by another process: timeout" errors. Switch to
--cache-backend memory to avoid bolt-db lock contention, matching the
approach already used in generate-sbom.sh.
Python was still reading DOCKERHUB_PAASUP_USER/TOKEN while the env:
block sets DOCKERHUB_USER/TOKEN, silently disabling private registry
auth. Also restore the nvcr.io (NGC) auth entry that was dropped.
Skip SBOM generation entirely since cve-edge-post.yml only needs
vulnerability counts, not CycloneDX artifacts — scan each image with
`trivy image` directly and aggregate with python3 (drop jq dependency).
Output is now a JSON array with one entry per image instead of a single
merged summary.
openmetadata 실패의 진짜 원인은 참조 오류가 아니라 docker.getcollate.io(Docker Hub 프록시)의
익명 pull rate limit(TOOMANYREQUESTS)였음. 인증 config 에 getcollate 를 추가(Docker Hub
자격증명)하고, 대용량 이미지 분석을 위해 trivy 타임아웃 기본값을 10m→15m(TRIVY_TIMEOUT).
로컬 검증: 인증+타임아웃으로 openmetadata server SBOM 생성 성공(655 comp).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- 아티팩트: 요약(trivy-summary.md/tsv)·sbom-index.tsv 를 최상위,
이미지별 상세 SBOM 을 sbom/ 하위로 배치. 절대경로 업로드 시 v4 가 전체
경로트리를 보존하던 문제를 스테이징 디렉토리 + 상대경로 업로드로 해결.
- workflow_dispatch 에 limit 입력 추가(0=전체, 테스트 시 소수만 생성).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
.github/workflows/sbom.yml 의 SBOM_PIPELINE_IMAGE 로 사용하는 실행 이미지
Dockerfile 을 doc/scripts/Dockerfile 로 추가(debian/glibc + helm/trivy/python3/git).
워크플로·sbom-pipeline.md 에서 상호 참조하도록 갱신.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ychangkim