Limit container image scanning to gh-* workflow images

[Copilot]

The daily container image scan was sweeping every container referenced by compiled workflow manifests, including third-party MCP and example images. This change narrows the scan set to GitHub-owned gh-* images so the workflow reports on the containers we maintain.

• Scope reduction

  • Filter manifest-derived container entries before deduplication so only images with a path component matching gh-* are included in images.json.
  • This keeps the scan focused on gh-aw and related GitHub-managed containers such as gh-aw-firewall/*, gh-aw-node, and gh-aw-mcpg.

• Workflow behavior

  • Preserve the existing manifest extraction, pin validation, vulnerability scanning, and issue reporting flow.
  • Only the candidate image set changes; downstream scan logic remains unchanged.

• Generated artifacts

  • Recompiled daily-squid-image-scan.lock.yml to keep the generated workflow in sync with the source workflow.

[
  .[].containers[]?
  | select(.image | test("(^|/)gh-[^/:@]+"))
]
| unique_by(.pinned_image)
| sort_by(.image)

[github-actions]

Hey @app/copilot-swe-agent 👋 — thanks for the focused cleanup on the container scanning workflow! This PR narrows the image scan scope to GitHub-owned containers, which is a solid operational improvement.

Here's what would help get this across the finish line:

• Add coverage for the filter logic — The new jq filter select(.image | test("(^|/)gh-[^/:@]+")) is the core of this change. A simple validation test (e.g., a jq test or a script that runs the filter against mock manifest data) would confirm the regex pattern works as intended and catches edge cases.
• Verify the filter doesn't exclude intended images — While the PR mentions gh-aw, gh-aw-firewall/*, gh-aw-node, and gh-aw-mcpg, a quick smoke test of the compiled manifest against the new filter would be reassuring.

The PR is already marked as draft with deferred action, which is fine. Once test coverage is added, this should be ready for merge.

If you'd like a hand, you can assign this prompt to your coding agent:

Add a validation test for the container image filter in .github/workflows/daily-squid-image-scan.md.

Test the jq filter: select(.image | test("(^|/)gh-[^/:@]+"))

Create a test script that:
1. Defines mock container entries (both matching and non-matching images)
2. Runs the filter against them
3. Verifies that gh-* images pass and non-gh images are filtered out
4. Includes edge cases like nested paths and digest formats

The test should be simple enough to run in CI and validate the filter logic.

Generated by ✅ Contribution Check · sonnet46 60 AIC · ⌖ 9.26 AIC · ⊞ 6.2K · ◷

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the daily squid image scan workflow to filter the set of container images collected from workflow lock manifests before generating images.json.

Changes:

• Adds a jq filter to include only containers whose .image matches (^|/)gh-[^/:@]+.
• Regenerates the workflow lock file metadata and applies the same jq change to the locked workflow.

Show a summary per file

File	Description
.github/workflows/daily-squid-image-scan.md	Narrows the images list via a jq select() filter before de-dup/sort.
.github/workflows/daily-squid-image-scan.lock.yml	Regenerates lock metadata and mirrors the image filtering logic in the locked workflow copy.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Low

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.83.1