WEEKEND HOMEWORK — Restaurant Company CI

Trivy is an open-source tool used for vulnerability scanning in containers, packages, and files. In the context of this homework, it is used to perform a vulnerability scan on the restaurant-company project.

fs stands for file system. In the context of Trivy, it refers to scanning files and directories within the file system.

. represents the current directory in the command. When using Trivy, the . means to scan the current directory and its contents.

Vuln stands for vulnerabilities. In the output of Trivy, it indicates that the scan is looking for known security vulnerabilities.

A CVE, or Common Vulnerabilities and Exposures, is a unique identifier assigned to publicly known cybersecurity vulnerabilities. It helps track and categorize security issues.

Severity refers to the level of risk associated with a vulnerability. In Trivy, vulnerabilities are categorized as LOW, MEDIUM, or HIGH, with HIGH being the most critical.

The difference between HIGH and MEDIUM severity is the potential impact of the vulnerability on the system. HIGH severity vulnerabilities pose a greater risk and should be addressed promptly.

In the first scan, no vulnerabilities were found because the project did not contain any known security issues, or the vulnerabilities were not present in the specific versions of the packages being used.

The scan with --include-dev-deps found vulnerabilities because it included development dependencies in the scanning process. Development dependencies may contain vulnerabilities that are not present in production dependencies.

No, 0 vulnerabilities does not mean an application is 100% secure. It simply means that no known vulnerabilities were identified in the current versions of the packages being used. New vulnerabilities may be discovered in the future, or the application could be vulnerable in ways that are not detected by vulnerability scanners.

1. A dependency is a package or library that a project relies on to function properly.

2. A transitive dependency is a dependency that a package depends on, which in turn depends on other packages. For example, if package A depends on package B, and package B depends on package C, then package C is a transitive dependency of package A.

3. nanoid is installed in the project to generate unique identifiers for various purposes, such as URLs or database keys.

4. PostCSS brings PostCSS into the project. PostCSS is a tool for transforming CSS with JavaScript plugins, and it is often used in combination with nanoid to generate unique identifiers.

5. nanoid is brought into the dependency tree by the postcss package. PostCSS includes nanoid as one of its plugins for generating unique identifiers.

An Installed Version refers to the version of a package currently installed in the project. A Fixed Version refers to the version that contains the fix for a particular vulnerability. If Trivy reports a fixed version, it means that a newer version of the package has been released that addresses the vulnerability.

A DevOps Engineer should care about dependency vulnerabilities because they can pose a significant security risk to the application. Vulnerabilities in dependencies can be exploited by attackers to gain unauthorized access, steal data, or disrupt the application's functionality. By regularly scanning for and addressing dependency vulnerabilities, a DevOps Engineer can help ensure the security and integrity of the application.

Parallel jobs in GitHub Actions allow multiple jobs to run simultaneously, improving the overall efficiency and speed of the Continuous Integration (CI) process. This is beneficial for large projects or those with multiple types of checks, as it can significantly reduce the time required to complete all checks and provide feedback to developers.

A GitHub Actions job is a self-contained unit of work that can be executed independently. A runner is a machine or service that executes the jobs defined in a GitHub Actions workflow. The difference between a job and a step is that a job is a collection of steps that share resources and can depend on each other, while a step is an individual action or command within a job.

Lint, SonarQube, and Trivy run independently because they each serve a different purpose in the CI process. Lint checks for code style and formatting, SonarQube performs code analysis and evaluates the Quality Gate, and Trivy scans for known vulnerabilities. Running them in parallel allows developers to get feedback on multiple aspects of their code more quickly.

1. Lint runs independently from Trivy because Lint checks code style and formatting, while Trivy scans for vulnerabilities. These are separate aspects of code quality, and running them independently allows for more efficient and faster feedback to developers.

2. Trivy does not need the SonarQube result before starting because they are separate checks that do not rely on each other's output. SonarQube evaluates the code quality and Quality Gate, while Trivy focuses solely on identifying vulnerabilities.


Part 7 — Push and create Pull Request

After completing the above steps, push the changes to the repository and create a Pull Request from the "weekend-ci-homework" branch to the "main" branch. Verify the execution of the GitHub Actions workflow by checking the GitHub Actions tab for the Lint, SonarQube, and Trivy jobs.