feat(ci): rescan main's images weekly and route drift to a tracking issue - #1717
Merged
Conversation
…ssue Container vulnerabilities are time-dependent, not commit-dependent. The gate added in #1710 runs where an image is built, so it catches a finding some change introduced and cannot catch one published after the code merged clean — which is what blocked v0.75.0, and what nothing notices today until a release fails. `rescan-main-images.yml` scans `<image>:main` on the same weekly cadence as the supported-release rescan, through the same `check-release-vulnerabilities.ts` and the same `security/vulnerability-policy.json`. It is not blocking: findings go to one tracking issue, opened when they appear, edited in place and commented when the set changes, silent when it has not, and closed when it clears. It recognises its own issue by an HTML marker carrying a fingerprint of the finding set, so it cannot open a duplicate every week and cannot adopt an unrelated issue. The Trivy database fetch was about to exist in a fourth copy, with only one of them carrying the ECR mirror fallback, so it is now one `download-trivy-db` composite action with optional freshness and metadata inputs. The release and the release rescan adopt it and gain the fallback. Closes #1706 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Approved automatically: @FelixTJDietrich is listed in the REVIEW_POLICY_MAINTAINERS repository variable, which the repository treats as satisfying the review requirement. See the review policy in docs/contributor/ci-cd.mdx.
github-actions
Bot
added
documentation
Contributor
📚 Documentation Preview
|
Contributor
🧩 Storybook Preview
|
Contributor
|
Warning Review limit reachedNext included review available in 59 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (12)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 1, 2026
This was referenced Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
rescan-main-images.yml: a weekly, non-blocking rescan of the images built frommain'sHEAD against the release vulnerability policy, with findings routed to a single tracking issue.
Container vulnerabilities are time-dependent, not commit-dependent. The gate #1710 added runs where
an image is built, so it catches a finding some change introduced and cannot catch one published
after the code merged clean — which is exactly what blocked v0.75.0, and what nothing notices today
until a release fails.
rescan-release-images.ymlalready covers published releases on thiscadence; this covers what
mainwould release today.Fixes #1706
What is reused, and what is new
Reused as-is, not re-derived:
scripts/check-release-vulnerabilities.tsandsecurity/vulnerability-policy.json. Oneevaluator, one policy.
scan-main-images.tsinvokes that script rather than importing orreimplementing it, so the
.policy.jsonresult files this run produces are byte-shaped exactlylike the build gate's and the release rescan's.
linux/amd64digest resolution — index first, single-manifest fallback, digest shapeasserted — lifted into
selectPlatformDigest, where it is now tested against a real index, asingle manifest, and the
unknown/unknownattestation manifest a multi-arch push also publishes.rescan-release-images.yml's shape: weekly cron,workflow_dispatch, non-cancellingconcurrency group,
setup-release-security-toolswithout Syft, artifact upload of the reports.New:
scripts/scan-main-images.ts— resolves each inventory image's:maintag to itslinux/amd64digest, scans it, evaluates the policy. A finding never fails the run; an unreachable registry, a
missing tag or a malformed report does. The evaluator is run silenced, because a green job
carrying
::error::annotations is how a team learns to read past them — but if it exits withoutwriting a result file (a malformed report or policy, not a finding) it is re-run with output and
the run fails, since unlike a CVE that is fixed by a commit.
scripts/report-vulnerability-drift.ts— the issue upsert, in kyvernosync-trivy-issuesshape.Creates when findings appear, edits in place and comments when the finding set changes, writes
nothing when it has not, and closes when it clears. It identifies its own issue by an HTML
marker carrying a fingerprint of the finding set, not by title: a title is editable, and a run
that cannot recognise its own issue opens a duplicate every week until someone turns the schedule
off. The fingerprint deliberately excludes the scan timestamp and run link, or every week would
look like a change.
Composite action: yes, and why
The Trivy database fetch — retry loop, mirror fallback, freshness assertion, metadata copy — was
about to exist in a fourth copy, and only #1710's carried the
public.ecr.aws/aquasecurity/trivy-dbfallback and the note that the:2schema tag tracks theTrivy version in
setup-release-security-tools. That is the same class of drift this whole effortis removing, so it is now
.github/actions/download-trivy-dbwith two optional inputs(
max-age-hours,metadata-path) covering all four call sites.release.ymlandrescan-release-images.ymladopt it and gain the mirror fallback;reusable-docker-build.yml'sscanjob loses ten lines. It is roughly line-neutral — the win is that the fallback and the schemapin are stated once instead of in one place out of four.
Changeset
None.
verify-changesetsscopesSHIPPED_PATHStoserver,webappanddocker; this PR touchesonly
.github/,scripts/anddocs/, sogit diff --name-only ... -- server webapp dockerisempty and the check does not require one.
How to test
CI covers this. 46
node:testcases acrossscripts/scan-main-images.test.ts(13),scripts/report-vulnerability-drift.test.ts(20) and the new/extendedscripts/ci-contract.test.tsassertions (3 new tests, existing one updated), including:
tracking issue rather than the newest, closes every tracking issue when the policy clears, and
never adopts an unrelated open
securityissue;security/vulnerability-policy.json, and exactly onesuch file is committed;
publishes or signs a scan result refuses a database over 24 h old.
pnpm run formatandpnpm run checkboth pass.The workflow can be exercised before the first Monday with
workflow_dispatch.Checklist