April 15th, 2024 Community Meeting

[qu1queee]

• Please add a topic in this thread and add a link to the GitHub issue associated with the topic.
• Please make sure you give folks enough time to review/discuss the topic offline on GitHub before coming into the meeting
• (optional) Paste the image of an animal 😸

[qu1queee]

I would not be able to join on this day.

[SaschaSchwarze0]

Any update on /cherry-pick ?

[adambkaplan]

Impact of SARIF on shipwright-io/build#1489

[adambkaplan]

Incoming blog post - build Quarkus apps with caching, based on https://youtu.be/6qgYK_ONH_I

[adambkaplan]

Minutes:

• Cherry-pick: needs a member of the OpenShift organization to verify/update the repo configuration in github.com/openshift/release.
• SARIF and SHIP-0033:
  • New standard, used by CodeQL and GitHub's scan feature. Trivy, Snyk, and other tools support SARIF outputs. We need time to digest and understand better (maybe bring in outside experts).
  • SHIP goes beyond running the scan. Desire to block build if CVE of certain severity is detected, ability to ignore a CVE (ex: known issue, impact is less severe in this codebase, etc.).
  • Worth looking into splitting sub-features out into individual PRs so basic functionality is available sooner.
  • Question: where should SARIF output go? Attach to container image using OCI references?
• Demo of Quarkus + Shipwright: beyond blog post (issues to be filed)
  • New sample strategies
  • Improvements to documentation
  • Convention for build caches?