ci: scan the release-candidate image before the tag, not after - #392
Merged
Conversation
docker-scan was gated on `schedule || push to main`, so it never ran on a PR
into main. docker-publish.yml triggers on the `v*` tag, which is pushed after
that merge — so the first time the container image gets scanned is after
customers can already pull it. For a security product that is the wrong order.
The job builds the image itself rather than pulling a published one, so nothing
prevented it running while the release is still reviewable; it just was not
asked to. Costs one extra image build per release PR, a handful per year.
Same change as ui#347, where the gap was also producing a red Trivy check
("1 configuration present on refs/heads/main was not found") because code
scanning compares a PR against the configurations on its base branch. api is
not red today only because main has no recorded analysis from this job to
compare against — the scanning gap is identical.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gap
So the container image is scanned on a weekly schedule and on push to
main—never on the PR that puts the code there.
docker-publish.ymltriggers onpush: tags: v*, and the tag goes onmainafter the release merge. So the sequence today is:
v0.4.0tag pushed — image built and publishedFor a security product, scanning the artifact after shipping it is the wrong
order.
The change
Run it for pull requests whose base is
mainas well. The job builds the imageitself (
push: false, load: true) rather than pulling a published one, so therewas never anything stopping it running earlier — it just was not asked to.
Costs one extra image build per release PR. Release PRs happen a handful of
times a year.
Why now
Found while clearing the red checks on the v0.4.0 release PRs. On
uithe samecondition also produced a failing Trivy check —
1 configuration present on refs/heads/main was not found— because codescanning compares a PR against the configurations present on its base branch,
and
mainexpects an analysis from this job.apiis not red today, but only becausemainhas no recorded analysisfrom this job to compare against. The scanning gap is identical; the symptom
just has not surfaced here. Fixed in
uias part of ui#347.