fix: migrate to image.yaml v2 and update ignored vulnerabilities for hydra - #1182
Merged
Conversation
alesancor1
requested changes
Aug 20, 2026
alesancor1
left a comment
alesancor1
left a comment
Member
There was a problem hiding this comment.
Hey @shipperizer, changes look good, thanks!
However, the usage of .trivyignore is deprecated in favour of the v2 trigger file, meaning you can move those to ignored-vulnerabilities field inside the image.yaml file. Check the docs here.
Also, for reference you can check any of:
shipperizer
changed the title
Contributor
Author
split to #1183 |
shipperizer
changed the title
alesancor1
requested changes
Aug 21, 2026
alesancor1
requested changes
Aug 21, 2026
alesancor1
left a comment
alesancor1
left a comment
Member
There was a problem hiding this comment.
Also, this PR is too broad. The scope of the PR should be kept to one single rock, as OCI-Factory will not be able to build multiple.
- Update image.yaml to version 2 for hydra - Add active unresolvable vulnerabilities to upload[*].ignored-vulnerabilities with explanations and links - Remove deprecated .trivyignore files
shipperizer
changed the title
zhijie-yang
approved these changes
Aug 24, 2026
zhijie-yang
left a comment
zhijie-yang
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for the clarification. Please note the comment regarding the application of the ignored vulnerabilities in the CLI call.
shipperizer
added a commit
to canonical/identity-team
that referenced
this pull request
Aug 24, 2026
## Description This PR updates the reusable rock OCI publishing workflow (`.github/workflows/_rock-oci-publish.yaml`) to support passing ignored vulnerabilities when triggering builds/releases via the `oci-factory` CLI. ### Changes - **Workflow input**: Added optional `ignore-vulnerabilities` string input (defaults to `""`) to accept a comma-separated list of vulnerability/CVE IDs to ignore. - **CLI argument formatting**: Formats and passes `--ignored-vulnerabilities=<ids>` to `oci-factory upload` commands for both stable and edge/candidate releases when specified. Whitespace is stripped to prevent shell argument splitting issues. - **Go version compatibility**: Updated `setup-go` version requirement from `>=1.22.0` to `>=1.25.0` to ensure compatibility with `github.com/canonical/oci-factory/tools/cli-client` which requires Go 1.25+. Ref: canonical/oci-factory#1182 (comment)
shipperizer
added a commit
to canonical/hydra-rock
that referenced
this pull request
Aug 24, 2026
…abilities - Update canonical/identity-team workflow references to v1.16.0 - Pass ignored vulnerabilities from canonical/oci-factory to _rock-oci-publish.yaml - Related to canonical/identity-team#142 and canonical/oci-factory#1182
shipperizer
added a commit
to canonical/hydra-rock
that referenced
this pull request
Aug 24, 2026
…abilities (#332) ## Description This PR updates the reusable `canonical/identity-team` workflow references to version [`v1.16.0`](https://github.com/canonical/identity-team/releases/tag/v1.16.0) (`e017941885bd1d17774bf7be2cbbb1d1abe80d9e`) and utilizes the new `ignore-vulnerabilities` input in the `oci-publish` job of `.github/workflows/ci.yaml`. ### Changes - Updated `canonical/identity-team` workflow references in `.github/workflows/ci.yaml` and `.github/workflows/cves.yaml` from `v1.15.0` to `v1.16.0`. - Configured `ignore-vulnerabilities` on the `_rock-oci-publish.yaml` job with the list of ignored CVEs / vulnerabilities defined in [`oci/hydra/image.yaml`](https://raw.githubusercontent.com/canonical/oci-factory/refs/heads/main/oci/hydra/image.yaml): - `CVE-2026-32286` - `CVE-2026-33818` - `CVE-2026-33997` - `CVE-2026-34040` - `CVE-2026-39821` - `CVE-2026-46600` - `CVE-2026-56853` - `CVE-2026-56858` - `CVE-2026-56859` - `CVE-2026-56860` - `CVE-2026-56862` - `GO-2026-5932` ### Related Work - canonical/identity-team#142 ([Release v1.16.0](https://github.com/canonical/identity-team/releases/tag/v1.16.0)): Added support for `ignore-vulnerabilities` in `_rock-oci-publish.yaml`. - canonical/oci-factory#1182: Upstream OCI Factory changes introducing ignored vulnerabilities support.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CVE-2024-34156,CVE-2025-22874,CVE-2026-25679) from Hydra.trivyignorelist..trivyignorefiles forhydrawith minimal active upstream CVEs, including GitHub Advisories / NVD links and descriptions.Validation
Verified with Trivy scans against the rock with the ignore files applied: