Shared/global trivy cache

[zestful-thud]

Thoughts on using ~/.pre-commit-trivy-cache as the cache location to avoid pulling the db for every repo?

[mxab]

Hi,
sorry for the late reply.

You mean that I should create ~/.pre-commit-trivy-cache dir on the host and then mount it into the trivy docker container?

I can try this, but I'm not sure if ~ will work on everyones machine

[rquadling]

As docker supports .env, having that file contain clear instructions on how to set it up for team based development.

Not everyone places the company's work in the same location, and not all of them use the same operating system, but everyone's Docker supports the .env.

As this file can be .gitignore'd, every member of the team has the option of adequate local configuration.

We use make a LOT for adding new entries that require configuration. For those that cannot be preset from local info, we put a value in that Make, and anything using the .env file, will complain about. So far though, the team "get's it", and we've been OK. When we need to add a new entry to the .env file, we add a small creation recipe in the makefile and it adds it all nicely documented, tells the team member about it (in case the default value is not know or where the value can be arbitrary in some manner).

It is a shame that Make is a the wrong tool to use, but that 1 command, being the base for everything on every project, for every developer, new and old, even if it is JUST to be a "what do I need to do". I guess NEWBIES README.md is also an option, but come on, who REALLY reads the documentation??!!! Fail left within the tooling is what we seem to prefer.