[TEST DO NOT MERGE] image-scan gate live test: vulnerable wolfi base - #31176
Closed
yucheng-berri wants to merge 4 commits into
Closed
[TEST DO NOT MERGE] image-scan gate live test: vulnerable wolfi base#31176yucheng-berri wants to merge 4 commits into
yucheng-berri wants to merge 4 commits into
Conversation
Builds the runtime image and scans it with Grype (pinned v0.114.0, sha256 verified), failing the build on fixable HIGH/CRITICAL across both OS/apk packages and language packages baked into the image. This catches the layer osv-scan is structurally blind to (Wolfi/apk OS packages and vendored deps like prisma's node engine), which is the structural reason the openssl CVE slipped past CI and a customer's image scanner flagged it. Grype runs as a pinned binary with a verified checksum, so there is no mutable-tag GitHub Action in the dependency chain and no vendor credentials in the scan job. The job uses read-only contents permissions and an empty top-level permissions block.
Previously the workflow's paths filter listed all 6 Dockerfile variants but the build step always targeted only the root Dockerfile, so a PR editing one of the other variants would have passed this check on an unchanged image it did not actually rebuild. Matrix-scan each variant so the gate covers what the trigger advertises. fail-fast is off so one variant's failure does not mask others.
…t of image-scan gate)
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
Author
|
Live test complete: gate caught the regression. All 6 matrix image-scan jobs failed with the expected openssl findings (CVE-2026-45447 / -34183 / -34180 / -42764 in libcrypto3/libssl3 3.6.2-r3, fixed in 3.6.3-r0). Closing and deleting the test branch. The grype image-scan gate (PR #31151) is verified end-to-end. |
Contributor
Author
|
Closed as DO NOT MERGE; live-test complete. |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live test of the image-scan gate added in PR #31151. Reverts the wolfi-base digest to the pre-#31133 vulnerable 31da6565 (openssl 3.6.2-r3) to confirm the matrix image-scan job fails on all 6 variants. Will close and delete the branch once the gate has demonstrably caught the regression.