feat(cve-check): check for cves

[Guillaumebeuzeboc]

Tested here: canonical/robotics-action-workflows-tests#4

[Guillaumebeuzeboc]

The multiple runners thing was integrated, although there is a limitation in GH reusable workflows and matrix output: https://github.com/orgs/community/discussions/17245

Should we remove the runner matrix from the workflow?

[artivis]

Could you also add an example of this to the '-test' repo?

Nevermind, just seen the follow up pr.

[artivis]

Why do we need to specify a runner? Can't we run an amd64 review-tools snaps on an arm64 snap? Can we download an arm64 snap file on an amd64 machine?

[Guillaumebeuzeboc]

I didn't find a way to specify the arch from the snap download command. This means that snap download download the snap from the architecture of the host.

[Guillaumebeuzeboc]

Usage:
  snap download [download-OPTIONS] <snap>

The download command downloads the given snap and its supporting assertions
to the current directory with .snap and .assert file extensions, respectively.

[download command options]
      --channel=            Use this channel instead of stable
      --edge                Install from the edge channel
      --beta                Install from the beta channel
      --candidate           Install from the candidate channel
      --stable              Install from the stable channel
      --revision=           Download the given revision of a snap
      --basename=           Use this basename for the snap and assertion files (defaults to <snap>_<revision>)
      --target-directory=   Download to this directory (defaults to the current directory)
      --cohort=             Download from the given cohort

[Guillaumebeuzeboc]

The review-tool is reporting CVEs that have a fix in main or universe.
Passed the 5 years of LTS, the fixes are only available in Pro for main and universe.
But after 2 years, only fixes main are available. This means, that the workflow will have to be deprecated for 2 years old+ core version snaps.
Does it still make sense to automate this?