Skip to content

Dev fix trivy#22

Merged
mm-psy merged 2 commits intodevelopfrom
dev-fix-trivy
Jan 27, 2026
Merged

Dev fix trivy#22
mm-psy merged 2 commits intodevelopfrom
dev-fix-trivy

Conversation

@mm-psy
Copy link
Owner

@mm-psy mm-psy commented Jan 27, 2026

No description provided.

@github-actions
Copy link

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@mm-psy mm-psy merged commit 8112659 into develop Jan 27, 2026
8 checks passed
mm-psy added a commit that referenced this pull request Jan 29, 2026
* Add dependency-review (#3)

* Add dependency-review

* Fix branch

* Add Scorecard supply-chain security (#2)

* Create docker-publish.yml (#7)

* Create dotnet (#6)

* Create dotnet.yml

* Add comment

* Test

* Test

* Enhance CI workflow with code coverage reporting and PR comments

* Fix wrong test run

* Refactor CI workflow to improve test result handling and add module test execution

* Enhance CI workflow by combining test and coverage reports, and updating paths for coverage files

* Enhance Submodel Element request handling(#8)

* Add dependabot-version-updates (#4)

* Add dependabot-version-updates

* Enhancement of DataEngine Implementation  (#12)

* Added example folder With Dpp-plugin  (#13)

* Restructure Dockerfile for improved build process and clarity (#14)

* Added Test Plugin and Example for 3 submodels using Test plugin (#11)

* #182: Test plugin review results (#17)

* #182: Rename of folder

* #182: Refinement of apiCollection Readmes and environments

* #182: Also rename of Aas.TwinEngine.Plugin.TestPlugin to AAS.TwinEngine.Plugin.TestPlugin in files

* Remove obsolete test project files and add new project files for Plugin testing

* Remove obsolete test project files and add new project files for Plugin testing

* #182: Rename of projects

* #182: Readme refined

* #182: Refinement of readme

* #182: Icons removed from readme

---------

Co-authored-by: Kevalkumar <kgi@mm-software.com>

* Add codeql (#5)

* Create codeql.yml

* Update branches

* Enhancement of DataEngine Implementation (#18)

* Add hotfix develop release branches to actions (#15)

* Update dependency-review.yml

* Update dotnet.yml

* Update docker-publish.yml

* Update docker-publish.yml to refine branch triggers and enhance Docker metadata extraction

* Fix image name

* Add manually trigger a workflow

* #257: Enhancement TestPlugin to verify access SubmodelElement inside a SubmodelCollection within a SubmodelList (#19)

* README.md with detailed DataEngine overview and feature descriptions (#22)

* Refactor SyncShellDescriptorsAsync to log errors and return instead of throwing exceptions for null checks (#20)

* Generate SBOM for Container & application (#23)

* Generate SBOM for application dependencies

* Generate Container SBOM and extract App SBOM. Push both to Artifacts.

* Pin actions by hash and ensure app path casing aligns with Dockerfile

* Exclude SBOM generation from PR runs

* Add groups dependabot (#24)

* Enhance example-Docker setup  (#16)

* Add manual trigger capability to .NET pipeline (#21)

* Merge main branch and resolved the security issue (#27)

* Dev fix trivy (#22)

* Fix image reference extraction for Trivy SBOM generation in Docker publish workflow

* Add step to extract first image tag for Trivy scanning in Docker publish workflow

* Dev fix trivy + tag rework (#23)

* Fix image reference extraction for Trivy SBOM generation in Docker publish workflow

* Add step to extract first image tag for Trivy scanning in Docker publish workflow

* Fix manual trigger value format in Docker publish workflow

* Fix tag generation logic for Docker image based on branch conditions

* Enhance tag generation logic for Docker image by adding priority to develop branch tags

* Fix tag generation logic for non-develop and non-release branches in Docker publish workflow

---------

Co-authored-by: Kevalkumar Ghelani <kgi@mm-software.com>
Co-authored-by: Hardi Shah <hsh@mm-software.com>
Co-authored-by: mm-hsn <hsn@mm-software.com>
Co-authored-by: rkg-mm <12029804+rkg-mm@users.noreply.github.com>
mm-psy added a commit that referenced this pull request Feb 10, 2026
* Add dependency-review (#3)

* Add dependency-review

* Fix branch

* Add Scorecard supply-chain security (#2)

* Create docker-publish.yml (#7)

* Create dotnet (#6)

* Create dotnet.yml

* Add comment

* Test

* Test

* Enhance CI workflow with code coverage reporting and PR comments

* Fix wrong test run

* Refactor CI workflow to improve test result handling and add module test execution

* Enhance CI workflow by combining test and coverage reports, and updating paths for coverage files

* Enhance Submodel Element request handling(#8)

* Add dependabot-version-updates (#4)

* Add dependabot-version-updates

* Enhancement of DataEngine Implementation  (#12)

* Added example folder With Dpp-plugin  (#13)

* Restructure Dockerfile for improved build process and clarity (#14)

* Added Test Plugin and Example for 3 submodels using Test plugin (#11)

* #182: Test plugin review results (#17)

* #182: Rename of folder

* #182: Refinement of apiCollection Readmes and environments

* #182: Also rename of Aas.TwinEngine.Plugin.TestPlugin to AAS.TwinEngine.Plugin.TestPlugin in files

* Remove obsolete test project files and add new project files for Plugin testing

* Remove obsolete test project files and add new project files for Plugin testing

* #182: Rename of projects

* #182: Readme refined

* #182: Refinement of readme

* #182: Icons removed from readme

---------

Co-authored-by: Kevalkumar <kgi@mm-software.com>

* Add codeql (#5)

* Create codeql.yml

* Update branches

* Enhancement of DataEngine Implementation (#18)

* Add hotfix develop release branches to actions (#15)

* Update dependency-review.yml

* Update dotnet.yml

* Update docker-publish.yml

* Update docker-publish.yml to refine branch triggers and enhance Docker metadata extraction

* Fix image name

* Add manually trigger a workflow

* #257: Enhancement TestPlugin to verify access SubmodelElement inside a SubmodelCollection within a SubmodelList (#19)

* README.md with detailed DataEngine overview and feature descriptions (#22)

* Refactor SyncShellDescriptorsAsync to log errors and return instead of throwing exceptions for null checks (#20)

* Generate SBOM for Container & application (#23)

* Generate SBOM for application dependencies

* Generate Container SBOM and extract App SBOM. Push both to Artifacts.

* Pin actions by hash and ensure app path casing aligns with Dockerfile

* Exclude SBOM generation from PR runs

* Add groups dependabot (#24)

* Enhance example-Docker setup  (#16)

* Add manual trigger capability to .NET pipeline (#21)

* Merge main branch and resolved the security issue (#27)

* Dev fix trivy (#22)

* Fix image reference extraction for Trivy SBOM generation in Docker publish workflow

* Add step to extract first image tag for Trivy scanning in Docker publish workflow

* Dev fix trivy + tag rework (#23)

* Fix image reference extraction for Trivy SBOM generation in Docker publish workflow

* Add step to extract first image tag for Trivy scanning in Docker publish workflow

* Fix manual trigger value format in Docker publish workflow

* Fix tag generation logic for Docker image based on branch conditions

* Enhance tag generation logic for Docker image by adding priority to develop branch tags

* Fix tag generation logic for non-develop and non-release branches in Docker publish workflow

* Psy test playwright (#35)

* Resolved container app errors related to AAS registry endpoint (#33)

* Fix :  TestPlugin : 404 - file entries (#34)

* feat: Update Docker publish workflow for tag handling (#32)

* Update Docker publish workflow for tag handling

* Update .github/workflows/docker-publish.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Clean up docker-publish.yml by removing empty line

Removed an empty line before the Export Application SBOM step.

* Add comment for priority setting

* Add clarifying comment to Docker tag rule for non-develop, non-release branches (exclude tags and PRs)

* Update tag extraction for Trivy scanning to prioritize highest tag

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Revert "feat: Update Docker publish workflow for tag handling (#32)" (#38)

This reverts commit a36238e.

* feat: Pin nugetcommand (#36)

* feat: Update Docker publish workflow for tag handling (#39)

* Update Docker publish workflow for tag handling

* Update .github/workflows/docker-publish.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Clean up docker-publish.yml by removing empty line

Removed an empty line before the Export Application SBOM step.

* Add comment for priority setting

* Add clarifying comment to Docker tag rule for non-develop, non-release branches (exclude tags and PRs)

* Update tag extraction for Trivy scanning to prioritize highest tag

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* #129: Created initial structure of C# Playwright API tests for TestPlugin

* #129: Added Environment.GetEnvironmentVariable("BASE_URL") to ApiTestBase

* #129: FluentAssertions removed and replaced usage by xunit Assert

* #129: Health test added

* #129: Unneeded configuration removed

* #129: Refinment of tests

* #129: Refinement of rest api test

* #129: String comparison refined

* #129: Throws argument null excepion of response is null

* #129: Set copy always for GetSubmodelDescriptorById_Reliability_Expected.json

* workflow_dispatch added to dependency-review (#41)

* #185: Workflow for plaaywright tests added

* Revert "workflow_dispatch added to dependency-review (#41)" (#43)

This reverts commit 4e5d5fc.

* fix: Update condition for publishing Playwright test results

---------

Co-authored-by: Kevalkumar Ghelani <kgi@mm-software.com>
Co-authored-by: Hardi Shah <hsh@mm-software.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: mm-hsn <hsn@mm-software.com>

---------

Co-authored-by: Kevalkumar Ghelani <kgi@mm-software.com>
Co-authored-by: Hardi Shah <hsh@mm-software.com>
Co-authored-by: mm-hsn <hsn@mm-software.com>
Co-authored-by: rkg-mm <12029804+rkg-mm@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
mm-psy added a commit that referenced this pull request Feb 17, 2026
* Add dependency-review (#3)

* Add dependency-review

* Fix branch

* Add Scorecard supply-chain security (#2)

* Create docker-publish.yml (#7)

* Create dotnet (#6)

* Create dotnet.yml

* Add comment

* Test

* Test

* Enhance CI workflow with code coverage reporting and PR comments

* Fix wrong test run

* Refactor CI workflow to improve test result handling and add module test execution

* Enhance CI workflow by combining test and coverage reports, and updating paths for coverage files

* Enhance Submodel Element request handling(#8)

* Add dependabot-version-updates (#4)

* Add dependabot-version-updates

* Enhancement of DataEngine Implementation  (#12)

* Added example folder With Dpp-plugin  (#13)

* Restructure Dockerfile for improved build process and clarity (#14)

* Added Test Plugin and Example for 3 submodels using Test plugin (#11)

* #182: Test plugin review results (#17)

* #182: Rename of folder

* #182: Refinement of apiCollection Readmes and environments

* #182: Also rename of Aas.TwinEngine.Plugin.TestPlugin to AAS.TwinEngine.Plugin.TestPlugin in files

* Remove obsolete test project files and add new project files for Plugin testing

* Remove obsolete test project files and add new project files for Plugin testing

* #182: Rename of projects

* #182: Readme refined

* #182: Refinement of readme

* #182: Icons removed from readme

---------

Co-authored-by: Kevalkumar <kgi@mm-software.com>

* Add codeql (#5)

* Create codeql.yml

* Update branches

* Enhancement of DataEngine Implementation (#18)

* Add hotfix develop release branches to actions (#15)

* Update dependency-review.yml

* Update dotnet.yml

* Update docker-publish.yml

* Update docker-publish.yml to refine branch triggers and enhance Docker metadata extraction

* Fix image name

* Add manually trigger a workflow

* #257: Enhancement TestPlugin to verify access SubmodelElement inside a SubmodelCollection within a SubmodelList (#19)

* README.md with detailed DataEngine overview and feature descriptions (#22)

* Refactor SyncShellDescriptorsAsync to log errors and return instead of throwing exceptions for null checks (#20)

* Generate SBOM for Container & application (#23)

* Generate SBOM for application dependencies

* Generate Container SBOM and extract App SBOM. Push both to Artifacts.

* Pin actions by hash and ensure app path casing aligns with Dockerfile

* Exclude SBOM generation from PR runs

* Add groups dependabot (#24)

* Enhance example-Docker setup  (#16)

* Add manual trigger capability to .NET pipeline (#21)

* Merge main branch and resolved the security issue (#27)

* Dev fix trivy (#22)

* Fix image reference extraction for Trivy SBOM generation in Docker publish workflow

* Add step to extract first image tag for Trivy scanning in Docker publish workflow

* Dev fix trivy + tag rework (#23)

* Fix image reference extraction for Trivy SBOM generation in Docker publish workflow

* Add step to extract first image tag for Trivy scanning in Docker publish workflow

* Fix manual trigger value format in Docker publish workflow

* Fix tag generation logic for Docker image based on branch conditions

* Enhance tag generation logic for Docker image by adding priority to develop branch tags

* Fix tag generation logic for non-develop and non-release branches in Docker publish workflow

* Psy test playwright (#35)

* Resolved container app errors related to AAS registry endpoint (#33)

* Fix :  TestPlugin : 404 - file entries (#34)

* feat: Update Docker publish workflow for tag handling (#32)

* Update Docker publish workflow for tag handling

* Update .github/workflows/docker-publish.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Clean up docker-publish.yml by removing empty line

Removed an empty line before the Export Application SBOM step.

* Add comment for priority setting

* Add clarifying comment to Docker tag rule for non-develop, non-release branches (exclude tags and PRs)

* Update tag extraction for Trivy scanning to prioritize highest tag

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Revert "feat: Update Docker publish workflow for tag handling (#32)" (#38)

This reverts commit a36238e.

* feat: Pin nugetcommand (#36)

* feat: Update Docker publish workflow for tag handling (#39)

* Update Docker publish workflow for tag handling

* Update .github/workflows/docker-publish.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Clean up docker-publish.yml by removing empty line

Removed an empty line before the Export Application SBOM step.

* Add comment for priority setting

* Add clarifying comment to Docker tag rule for non-develop, non-release branches (exclude tags and PRs)

* Update tag extraction for Trivy scanning to prioritize highest tag

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* #129: Created initial structure of C# Playwright API tests for TestPlugin

* #129: Added Environment.GetEnvironmentVariable("BASE_URL") to ApiTestBase

* #129: FluentAssertions removed and replaced usage by xunit Assert

* #129: Health test added

* #129: Unneeded configuration removed

* #129: Refinment of tests

* #129: Refinement of rest api test

* #129: String comparison refined

* #129: Throws argument null excepion of response is null

* #129: Set copy always for GetSubmodelDescriptorById_Reliability_Expected.json

* workflow_dispatch added to dependency-review (#41)

* #185: Workflow for plaaywright tests added

* Revert "workflow_dispatch added to dependency-review (#41)" (#43)

This reverts commit 4e5d5fc.

* fix: Update condition for publishing Playwright test results

---------

Co-authored-by: Kevalkumar Ghelani <kgi@mm-software.com>
Co-authored-by: Hardi Shah <hsh@mm-software.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: mm-hsn <hsn@mm-software.com>

* Bump the major-minor-patch group across 1 directory with 7 updates (#39)

Bumps the major-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.11.1` | `3.12.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.6.0` | `3.7.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.0.1` | `5.1.0` |
| [dorny/test-reporter](https://github.com/dorny/test-reporter) | `2.3.0` | `2.5.0` |
| [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `2.9.0` | `2.9.4` |



Updates `actions/checkout` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8e8c483...de0fac2)

Updates `docker/setup-buildx-action` from 3.11.1 to 3.12.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@e468171...8d2750c)

Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

Updates `actions/upload-artifact` from 4.6.2 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.6.2...b7c566a)

Updates `actions/setup-dotnet` from 5.0.1 to 5.1.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@2016bd2...baa11fb)

Updates `dorny/test-reporter` from 2.3.0 to 2.5.0
- [Release notes](https://github.com/dorny/test-reporter/releases)
- [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md)
- [Commits](dorny/test-reporter@fe45e95...b082adf)

Updates `marocchino/sticky-pull-request-comment` from 2.9.0 to 2.9.4
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](marocchino/sticky-pull-request-comment@331f8f5...7737449)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: major-minor-patch
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-minor-patch
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-minor-patch
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-minor-patch
- dependency-name: actions/setup-dotnet
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-minor-patch
- dependency-name: dorny/test-reporter
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-minor-patch
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-version: 2.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: major-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Kevalkumar Ghelani <kgi@mm-software.com>
Co-authored-by: Hardi Shah <hsh@mm-software.com>
Co-authored-by: mm-hsn <hsn@mm-software.com>
Co-authored-by: rkg-mm <12029804+rkg-mm@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments