After merging the initial implementation of our Gitlab pipeline container-scanning solution (T307523, MR), I noticed a couple of issues within our testing repository:
- The trivy output can be quite verbose when it finds vulnerabilities (example). Is there a way to make this less verbose? If not, I guess that's ok, as we can still get to the complete output (example), but that's a bit less ideal.
- The trivy job seems to be (potentially) returning successful exit codes even when it finds vulnerabilities (example pipeline, example job). I would imagine that if trivy finds any vulnerabilities, we'd want to return a positive exit code? Similar to how all of the other application security includes work?