-
Notifications
You must be signed in to change notification settings - Fork 1.8k
🎉 Add fix_available to Trivy #13057
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
🎉 Add fix_available to Trivy #13057
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like this idea of populating the fix_available field in ways like this. Would it be helpful/needed to add to each parser doc how the field is populated? I remember a PR that was documenting for some parsers which fields from the report were parsed and how they were mapped. We could use AI to complete this for all parsers and then keep it up-to-date with parser changes?
Or even without that we could start adding a line to the docs of the parsers that set fix_available to indicate how the parsers decides on the value of the field? This is especially valuable if the value is derived from other fields or based on text matching of another field.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should these fix_available PRs have a migration to set the field for existing findings?
Should they be combined into one PR to make it manageable for thsi release?
I guess they don't need a migration as reimport with this PR #12922 will take care of this earlier or later |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Lots of people are using import
and will have lots of existing findings. But I'm OK to keep it simple for now.
But I do think we need to add a line to the docs.
#12633 (comment)