Github workflow for scanning CVEs #58290

Activity

1. h3pdesign commented on Aug 26, 2026

   

   h3pdesign

   on Aug 26, 2026

   More actions

   Great exactly what we need
2. zhangxinyao88 commented on Sep 7, 2026

   

   zhangxinyao88

   on Sep 7, 2026

   Contributor

   More actions

   Thanks for the Iceberg reference — I’d like to take this.

   To keep an initial implementation useful but bounded, would it make sense to scan a representative Spark binary distribution / bundled JAR set rather than the full release matrix?

   My proposed first scope is:

   • a read-only workflow, with pinned actions;
   • HIGH/CRITICAL dependency findings only;
   • PR runs fail on findings, while upstream push or scheduled runs report findings for tracking;
   • SARIF upload only on upstream runs, so fork PRs do not require elevated permissions;
   • reviewed ignore files for accepted exceptions.

   If that direction matches the maintainers’ expectations, I can put together a focused PR.