feat(ecr): real image scanning via optional Trivy CLI

[vieiralucas]

Summary

ECR's StartImageScan now performs a real vulnerability scan when the optional Trivy CLI is available. Layers are reconstructed as a docker-format tar, fed to `trivy image --input --format json`, and the parsed CVE output is exposed via DescribeImageScanFindings (severities, CVE IDs, package versions, fix info, primary URL). When Trivy isn't installed, scans complete with an empty findings list so client plumbing keeps working without forcing the dep.

• New `crates/fakecloud-ecr/src/scanner.rs` (detection, tar build, Trivy subprocess, JSON parser)
• StartImageScan spawns the scan in the background; DescribeImageScanFindings polls and observes IN_PROGRESS -> COMPLETE
• FAKECLOUD_TRIVY_BIN env var overrides the binary path
• Drops legacy `isSynthetic` response field (fakecloud-only marker, misleading once real Trivy results can land here)

Test plan

• cargo test -p fakecloud-ecr --lib (parser + severity mapping + env override)
• cargo test -p fakecloud-e2e --test ecr start_image_scan_transitions_to_complete
• cargo test -p fakecloud-e2e --test ecr_scan_synthetic_flag (rewritten to assert AWS-shaped response)
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all
• CI green
• Cubic clean

---

Summary by cubic

ECR image scans now run real vulnerability analysis using the optional Trivy CLI and return parsed CVE findings via DescribeImageScanFindings. Scans run in the background; if Trivy isn’t available, they complete with empty findings so clients still work.

• New Features

  • Reconstruct layers as a Docker tar and invoke trivy image --input <tar> --format json (scans only layers referenced by the image’s manifest).
  • Map severities and include CVE ID, package/version, fixed version, and primary URL in findings.
  • StartImageScan sets status to IN_PROGRESS; DescribeImageScanFindings returns COMPLETE when done.
  • FAKECLOUD_TRIVY_BIN overrides the Trivy binary path; persists results to the snapshot; added crates/fakecloud-ecr/src/scanner.rs; unit + e2e tests; docs updated. On tar/decode or Trivy errors, we log and fall back to a synthetic empty result.

• Migration

  • Removed the fakecloud-only isSynthetic field from DescribeImageScanFindings; drop any checks for it.
  • To get real findings locally or in CI, install Trivy (or set FAKECLOUD_TRIVY_BIN); otherwise you’ll receive a valid response with empty findings.

^{Written for commit 8b94e4a. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 8 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-e2e/tests/ecr_scan_synthetic_flag.rs">

<violation number="1" location="crates/fakecloud-e2e/tests/ecr_scan_synthetic_flag.rs:83">
P3: Use an absence check here; `is_null()` can’t distinguish a missing field from an explicit `null`, so this test would still pass if `isSynthetic` were returned as `null`.</violation>
</file>

<file name="crates/fakecloud-ecr/src/scanner.rs">

<violation number="1" location="crates/fakecloud-ecr/src/scanner.rs:106">
P2: Do not swallow base64 decode errors when rebuilding layers; return an error so the scan can fail/fallback explicitly instead of scanning empty layers.</violation>
</file>

<file name="crates/fakecloud-ecr/src/service.rs">

<violation number="1" location="crates/fakecloud-ecr/src/service.rs:1946">
P1: `StartImageScan` scans all repository layers instead of only the target image’s layers, so findings can be contaminated by other images in the repo.</violation>

<violation number="2" location="crates/fakecloud-ecr/src/service.rs:1971">
P1: Background scan completion updates `scan_findings` without triggering snapshot persistence, so completed results can be lost and restored as permanently `IN_PROGRESS` after restart.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[codecov]

Codecov Report

❌ Patch coverage is 43.52159% with 170 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-ecr/src/scanner.rs	59.00%	91 Missing ⚠️
crates/fakecloud-ecr/src/service.rs	0.00%	79 Missing ⚠️

📢 Thoughts on this report? Let us know!