Allow using GITHUB_TOKEN in the Trivy plugin

[estar-platform-team]

Our Trivy plugin container is crashing and the last few error lines are

1.7385860129482949e+09  error  v1/handler.go:66  failed to policy details  {"error": "GHSA-32gq-x56h-299c: GET https://api.github.com/advisories/GHSA-32gq-x56h-299c: 403 API rate limit exceeded for 3.75.66.29. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.) [rate reset in 28m30s]"}
1.7385860147505121e+09  error  v1/handler.go:66  failed to policy details  {"error": "GHSA-mh55-gqvf-xfwm: GET https://api.github.com/advisories/GHSA-mh55-gqvf-xfwm: 403 API rate limit of 60 still exceeded until 2025-02-03 13:01:48 +0000 UTC, not making remote request. [rate reset in 28m13s]"}
1.7385860147506497e+09  error  v1/handler.go:66  failed to policy details  {"error": "GHSA-xpw8-rcwv-8f8p: GET https://api.github.com/advisories/GHSA-xpw8-rcwv-8f8p: 403 API rate limit of 60 still exceeded until 2025-02-03 13:01:48 +0000 UTC, not making remote request. [rate reset in 28m13s]"}

We tried running the container with the GITHUB_TOKEN env var but it does not seem to have an effect

We tried running the container with logLevel: -1 but it does not seem to have an effect either, so we cannot verify github is the cause or there is something else happening between the API rating and the container crash

[fjogeleit]

Thanks I will take a Look on this. Don’t think the env is currently Supported. Will add this Feature.

[fjogeleit]

The newest release should support setting the github token for authenticated calls via the plugin.trivy.github.token configuration or via GITHUB_TOKEN env. Can be set via envVars: https://github.com/kyverno/policy-reporter/blob/main/charts/policy-reporter/values.yaml#L1459