feat(ci): scan published images for CVEs daily - #3
Merged
Conversation
Add scan.yaml: a daily Trivy sweep of every published image, one job per image per platform on its native runner so the manifest list resolves to the right arch, reporting HIGH/CRITICAL findings to GitHub code scanning. A CVE disclosed after an image ships only surfaces on a re-scan, so the build workflow cannot catch it. The scan reports rather than gates. Every current finding sits in a vendored upstream artefact (Go binaries, the runner's .NET runtime, npm's bundled dependencies) where a patched module exists but these images only consume a release build, so a merge gate would block PRs on work this repo cannot do. Upgrade npm in the Node-based images to clear what is actionable: the bundled npm carries tar, undici and brace-expansion CVEs that only move by upgrading npm itself. infisical-mcp drops from 5 findings to 1 (including the sole CRITICAL), sandbox-agent from 7 to 3; the rest need upstream rebuilds. infisical-mcp takes a -1 revision suffix since the upstream MCP version is unchanged, and loses the annotation above its version field: a -N suffix is a semver pre-release that Renovate would upgrade straight back to the bare release. Upstream tracking stays on INFISICAL_MCP_VERSION. claude-code inherits npm from sandbox-agent and needs a follow-up base digest bump, which cannot ride along here: build runs a flat matrix with no per-image ordering, so it would build against the currently published base. Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/workflows/scan.yaml: a daily Trivy sweep of every published image, plusworkflow_dispatch. One job per image per platform (13 jobs) on its native runner, so the manifest list resolves to the arch being scanned. HIGH/CRITICAL results upload to GitHub code scanning under a per-image/platform category. A CVE disclosed after an image ships only surfaces on a re-scan, sobuild.yamlstructurally cannot catch it.It reports, it does not gate. All 82 findings across the 7 published images are
lang-pkgs; there are zero OS-package findings. They live in vendored upstream artefacts (the runner's .NET runtime, containerd/docker Go modules, thekubectl/rrda/ghbinaries) where a patched upstream module exists but these images only consume a release build. Trivy calls those "fixable", so--ignore-unfixeddoes not filter them and a merge gate would block every PR on work this repo cannot do.Also upgrades npm in the two Node-based images to clear what is actionable. The bundled npm ships
tar,undiciandbrace-expansionCVEs under/usr/local/lib/node_modules/npm/, movable only by upgrading npm itself. Pinned tonpm@12.0.1with a Renovate annotation; verified against the 12.0.1 tarball (tar7.5.19,undici6.27.0,brace-expansion5.0.7) and itsengines(^24.15.0) against the 24.18.0 both images run.infisical-mcpsandbox-agentResidual:
brace-expansionCVE-2026-14257 needs 5.0.8, which no npm release bundles yet (Renovate will pick it up); the other two aregh's Go stdlib and grpc, pending a cli/cli rebuild.Version bumps per the README rules:
sandbox-agent1.0.0 → 1.0.1 (PATCH rebuild).infisical-mcp0.0.23 → 0.0.23-1, since upstream has not moved — and itsversion:field loses the Renovate annotation, because a-Nsuffix is a semver pre-release that would be "upgraded" straight back to the bare release. That is the trapactions-runneralready documents; upstream tracking stays onINFISICAL_MCP_VERSIONin the Dockerfile.Not in this PR
claude-codeisFROM ghcr.io/cloudsnacks/sandbox-agent:1.0.0@sha256:..., so its 7 findings clear only once that pin moves. It cannot ride along:buildis a flat matrix over image × platform with no per-image ordering andmergewaits on all of it, soclaude-codewould build against the currently published base. Needs a follow-up oncesandbox-agent:1.0.1publishes — Renovate'sdockerfilemanager should propose the digest, but theversion:field needs the same-1+ de-annotation treatment applied toinfisical-mcphere.Test plan
hadolint -c .hadolint.yamlclean on both changed Dockerfilesactionlintclean onscan.yaml(pre-existing warnings inbuild.yamluntouched)dev-desktopas amd64-onlycontainer;metadata.yamlsmoke tests pass;npm --versionreports 12.0.1 andid -uis 1001Scanrun seeds code scanning (no analysis exists in this repo yet)