fix(ci): scan both platforms upstream and derive the gate's trigger

Two review findings on the upstream scan, both real.

The `release-images` path filter listed the gate's entry point but not the
modules it loads, so a pull request touching `scripts/lib/json.ts` or
`scripts/lib/process.ts` passed `release_images_changed: false` and skipped the
scan. The closure is five files. Rather than trust a hand-maintained list — the
same drift this PR exists to prevent — `ci-contract.test.ts` now re-walks the
imports from the entry point and asserts every file it reaches appears in the
filter, so the enumeration cannot fall behind the code.

`scanAll` resolved only `linux/amd64`, while an exception matches on
`image | platform | vulnerability | package | installedVersion`. A single-platform
pre-release scan half-checks each subject, leaving an arm64-only finding — or an
arm64 exception nobody wrote — to the release gate by construction. The upstream
scan now covers both platforms, and `ScanOutcome` carries the platform so a
result can name which half it is.

`scan-main-images.ts` stays `linux/amd64`: a finding on either architecture of an
image we build is fixed by the same rebuild, and the Version PR preflight scans
both before a release is cut. A pinned upstream digest has no rebuild and its fix
arrives as a digest bump in a pull request, so that scan cannot defer half a
subject. Both the script and the remediation guide now say so.

Verified: arm64 evidence re-gathered rather than assumed — qemu is unavailable,
so the arm64 binaries were extracted and read with `readelf`. nats-server and
traefik are static AArch64 executables with no dynamic section at all, nginx
links libssl/libcrypto and not libexpat, and its embedded configure line carries
the same --with-http_v3_module. Every justification holds unchanged, the arm64
finding sets are identical to amd64, and the gate reports all eight subjects
pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

.github/workflows/ci-security-scan.yml

@@ -54,7 +54,7 @@ jobs:
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: vulnerability-policy-upstream-linux-amd64
+          name: vulnerability-policy-upstream
           path: reports
           if-no-files-found: warn
           retention-days: 7

.github/workflows/cicd.yml

@@ -199,12 +199,16 @@ jobs:
               - '.github/workflows/ci-security-scan.yml'
             release-images:
               # The pinned upstream digests need no build, so the pull request that edits them —
-              # a Renovate digest bump included — is the one that scans them (#1741).
+              # a Renovate digest bump included — is the one that scans them (#1741). The script
+              # entries are the gate's whole transitive import closure, which ci-contract.test.ts
+              # re-derives from the imports and asserts against this list.
               - 'security/release-images.json'
               - 'security/vulnerability-policy.json'
               - 'scripts/scan-upstream-images.ts'
-              - 'scripts/lib/image-scan.ts'
               - 'scripts/check-release-vulnerabilities.ts'
+              - 'scripts/lib/image-scan.ts'
+              - 'scripts/lib/json.ts'
+              - 'scripts/lib/process.ts'
               - '.github/workflows/ci-security-scan.yml'
             docker-config:
               - '.github/workflows/ci-docker-build.yml'

docs/contributor/vulnerability-remediation.mdx

@@ -29,9 +29,9 @@ attached to the release; the filter is in the evaluator, not a `--ignore-unfixed
 | When | Subject | Effect |
 | --- | --- | --- |
 | Every image build (`reusable-docker-build.yml`) | the `linux/amd64` image the run just pushed | fails the run |
-| A pull request touching `security/release-images.json` (`ci-security-scan.yml`) | the `linux/amd64` side of each pinned upstream digest | fails the run |
+| A pull request touching `security/release-images.json` (`ci-security-scan.yml`) | both platforms of each pinned upstream digest | fails the run |
 | Release evidence (`release.yml`) | both platforms of every first-party and upstream image | no release is created |
-| Weekly (`rescan-main-images.yml`) | the `linux/amd64` image behind each `:main` tag, and each pinned upstream digest | opens or updates a tracking issue |
+| Weekly (`rescan-main-images.yml`) | the `linux/amd64` image behind each `:main` tag, and both platforms of each pinned upstream digest | opens or updates a tracking issue |
 | Weekly (`rescan-release-images.yml`) | every subject in the latest published release | fails and comments on [the vulnerability response issue](https://github.com/ls1intum/Hephaestus/issues/1369) |
 
 All five evaluate `security/vulnerability-policy.json` through `scripts/check-release-vulnerabilities.ts`;
@@ -48,6 +48,15 @@ A pinned upstream image cannot be patched by rebuilding anything here. Its remed
 `security/release-images.json` — which Renovate proposes, and which the pull request proposing it now
 scans — and until upstream republishes the tag there may be no digest to bump to.
 
+That is also why the upstream scan covers both platforms while the scans of images we build cover
+`linux/amd64` only. An exception matches on `image | platform | vulnerability | package |
+installedVersion`, so a single-platform scan can only ever half-check a subject. For an image we
+build, the other half costs little to leave to the release: a finding on either architecture is
+fixed by the same rebuild, and the Version PR preflight scans both before the release is cut. For a
+pinned upstream digest there is no rebuild, the fix is a digest bump nobody can make until upstream
+publishes one, and the bump arrives in a pull request — so an arm64-only finding has to fail that
+pull request rather than the release.
+
 ## Exceptions
 
 An exception lets one fixable finding through for at most 90 days. It is an entry in

scripts/ci-contract.test.ts

@@ -1,12 +1,14 @@
 import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
 import { glob, readFile } from "node:fs/promises";
+import path from "node:path";
 import { describe, test } from "node:test";
 
 import { type Document, isMap, isSeq, parseDocument, type YAMLMap } from "yaml";
 
 import { planRelease, releaseOutputs } from "./plan-release.ts";
 import { planSubjects } from "./scan-main-images.ts";
-import { planUpstreamSubjects } from "./scan-upstream-images.ts";
+import { PLATFORMS, planUpstreamSubjects } from "./scan-upstream-images.ts";
 import { validateManifest } from "./verify-release-evidence.ts";
 
 function job(source: string, name: string): string {
@@ -40,6 +42,30 @@ function escapeRegExp(value: string): string {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+/**
+ * Every repository script a given entry point loads, transitively — its static relative imports,
+ * plus any sibling script it names as a string, which is how the scanners reach the policy
+ * evaluator (they spawn it rather than importing it, so that its exit status is the verdict).
+ */
+async function importClosure(entry: string): Promise<string[]> {
+	const seen = new Set<string>();
+	const queue = [entry];
+	while (queue.length > 0) {
+		const file = queue.shift();
+		if (file === undefined || seen.has(file)) continue;
+		seen.add(file);
+		const source = await readFile(file, "utf8");
+		const directory = path.dirname(file);
+		for (const [, specifier] of source.matchAll(/from\s+"(\.[^"]+\.ts)"/g))
+			queue.push(path.normalize(path.join(directory, specifier ?? "")));
+		for (const [, name] of source.matchAll(/"([\w.-]+\.ts)"/g)) {
+			const candidate = path.normalize(path.join(directory, "..", name ?? ""));
+			if (candidate.startsWith("scripts/") && existsSync(candidate)) queue.push(candidate);
+		}
+	}
+	return [...seen].toSorted();
+}
+
 /** The `with` map of the first step in a job whose `uses` starts with `action`. */
 function step(workflow: Document, jobPath: string[], action: string): YAMLMap {
 	const steps = workflow.getIn([...jobPath, "steps"]);
@@ -445,10 +471,28 @@ void describe("CI contract", () => {
 			/run: node scripts\/scan-upstream-images\.ts reports --report-only\n/,
 		);
 		const detection = job(await readFile(".github/workflows/cicd.yml", "utf8"), "detect-changes");
+		const filter = pathFilter(detection, "release-images");
 		assert.match(
-			pathFilter(detection, "release-images"),
+			filter,
 			/- 'security\/release-images\.json'[\s\S]*- 'security\/vulnerability-policy\.json'/,
 		);
+		// The trigger is derived, not trusted: a filter that lists the entry point but not the module
+		// it parses JSON with skips the gate on the pull request that breaks the parser. Re-walk the
+		// imports and require every file the gate actually loads to appear.
+		for (const file of await importClosure("scripts/scan-upstream-images.ts"))
+			assert.ok(
+				filter.includes(`- '${file}'`),
+				`release-images must trigger on ${file}, which the upstream scan loads`,
+			);
+	});
+
+	void test("scans both released platforms before the release, not just linux/amd64", async () => {
+		// The policy match key is `image | platform | vulnerability | package | installedVersion`, so
+		// a single-platform pre-release scan leaves an arm64-only finding — or an arm64 exception
+		// nobody wrote — to be discovered by the release gate, which is the failure this PR removes.
+		assert.deepEqual([...PLATFORMS], ["linux/amd64", "linux/arm64"]);
+		const source = await readFile("scripts/scan-upstream-images.ts", "utf8");
+		assert.match(source, /for \(const platform of PLATFORMS\)/);
 	});
 
 	void test("rescans main's images weekly and reports drift to an issue, not a status", async () => {

scripts/lib/image-scan.ts

@@ -15,8 +15,8 @@ import path from "node:path";
 import { asRecord, isRecord } from "./json.ts";
 import { output, run, succeeds } from "./process.ts";
 
-/** The one platform these scans cover. Alpine and Debian ship the same package versions across
- * architectures, and the release still scans both, where the evidence bundle must be complete. */
+/** The platform a caller gets when it names none. Callers that must match the release evidence
+ * gate, which is keyed per platform, name both — see `scan-upstream-images.ts`. */
 export const PLATFORM = "linux/amd64";
 
 const DIGEST = /^sha256:[a-f0-9]{64}$/;
@@ -32,6 +32,9 @@ export interface ScanOutcome {
 	readonly image: string;
 	/** `false` when the policy evaluator rejected something; never throws the run. */
 	readonly passed: boolean;
+	/** Carried because the policy match key is per platform, so an outcome that does not name one
+	 * cannot be reported or compared against the release gate's subjects. */
+	readonly platform: string;
 }
 
 export interface ScanOptions {
@@ -130,15 +133,16 @@ async function scan(
 		"security/vulnerability-policy.json",
 		result,
 	];
-	if (await evaluatorPassed(evaluator, annotate)) return { image: subject.image, passed: true };
+	if (await evaluatorPassed(evaluator, annotate))
+		return { image: subject.image, passed: true, platform };
 	if (!existsSync(result)) {
 		// It threw before writing anything — a malformed report or policy, not a finding. Re-run so
 		// the reason reaches the log, then fail: this is an infrastructure failure, and unlike a CVE
 		// it is fixed by a commit.
 		await run("node", evaluator);
 		throw new Error(`vulnerability policy evaluation produced no result for ${subject.image}`);
 	}
-	return { image: subject.image, passed: false };
+	return { image: subject.image, passed: false, platform };
 }
 
 export async function scanAll(

scripts/scan-main-images.ts

@@ -11,6 +11,11 @@
  * the release evidence gate demands. Both share `lib/image-scan.ts`, which hands each Trivy report
  * to `check-release-vulnerabilities.ts`.
  *
+ * Only `linux/amd64`, unlike the upstream scan, which covers both. A finding on either architecture
+ * of an image we build is fixed by the same rebuild, and the Version PR preflight scans both before
+ * a release is cut; a pinned upstream digest has no rebuild and its fix arrives as a digest bump in
+ * a pull request, so that scan cannot leave half a subject to the release gate.
+ *
  * A finding never fails this run. `report-vulnerability-drift.ts` reads the `.policy.json` files
  * written here and routes them to a tracking issue; only an infrastructure failure — a missing tag, an
  * unreachable registry, a Trivy crash — is worth a red status on a schedule nobody triggered.

scripts/scan-upstream-images.ts

@@ -8,8 +8,8 @@
  * been there for days (issue #1741).
  *
  * They need no build — a digest in a committed file is the whole subject — so this is cheap and
- * deterministic, and it blocks by default. A Renovate digest bump edits this very file, so the pull
- * request proposing the bump is the one that scans it.
+ * deterministic, it covers both released platforms, and it blocks by default. A Renovate digest
+ * bump edits this very file, so the pull request proposing the bump is the one that scans it.
  *
  * `--report-only` is the weekly rescan, where a finding is routed to a tracking issue rather than a
  * red status: a CVE published after the digest was pinned belongs to no commit, and a pinned
@@ -18,11 +18,19 @@
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
 
-import { PLATFORM, scanAll, type Subject } from "./lib/image-scan.ts";
+import { type ScanOutcome, scanAll, type Subject } from "./lib/image-scan.ts";
 import { asArray, asRecord, asString, readJsonFile } from "./lib/json.ts";
 
 const DIGEST = /^sha256:[a-f0-9]{64}$/;
 
+/**
+ * Both platforms, because the release evidence gate scans both and an exception matches on
+ * `image | platform | vulnerability | package | installedVersion`. Scanning only `linux/amd64`
+ * would leave an arm64-only finding — or an arm64 exception nobody wrote — discoverable for the
+ * first time at the release, which is the failure this whole script exists to remove.
+ */
+export const PLATFORMS = ["linux/amd64", "linux/arm64"] as const;
+
 export interface UpstreamSubject extends Subject {
 	/** The multi-architecture index digest pinned in the inventory, which is what the release
 	 * manifest records as each platform subject's `indexDigest`. */
@@ -53,14 +61,20 @@ if (import.meta.main) {
 		throw new Error("usage: scan-upstream-images <directory> [--report-only]");
 	const reportOnly = option === "--report-only";
 	const subjects = planUpstreamSubjects(await readJsonFile("security/release-images.json"));
-	const outcomes = await scanAll(subjects, directory, { annotate: !reportOnly });
+	const outcomes: ScanOutcome[] = [];
+	for (const platform of PLATFORMS)
+		outcomes.push(...(await scanAll(subjects, directory, { annotate: !reportOnly, platform })));
 	await writeFile(
 		path.join(directory, "upstream-scan.json"),
-		`${JSON.stringify({ platform: PLATFORM, scannedAt: new Date().toISOString(), subjects }, null, 2)}\n`,
+		`${JSON.stringify({ platforms: PLATFORMS, scannedAt: new Date().toISOString(), subjects }, null, 2)}\n`,
 	);
 	for (const outcome of outcomes)
-		process.stdout.write(`${outcome.image}: ${outcome.passed ? "pass" : "fail"}\n`);
-	const failed = outcomes.filter((outcome) => !outcome.passed).map((outcome) => outcome.image);
+		process.stdout.write(
+			`${outcome.image} (${outcome.platform}): ${outcome.passed ? "pass" : "fail"}\n`,
+		);
+	const failed = outcomes
+		.filter((outcome) => !outcome.passed)
+		.map((outcome) => `${outcome.image} (${outcome.platform})`);
 	if (failed.length > 0 && !reportOnly) {
 		process.stderr.write(
 			`::error::pinned upstream images do not satisfy the vulnerability policy: ${failed.join(", ")}\n`,