ci: the weekly security sweep never scanned the container image - #338
Merged
Conversation
docker-scan was gated on `github.event_name == 'push'`, which excludes the `schedule` event. So the Monday cron — the one run whose whole purpose is to catch CVEs disclosed since the last commit — built no image and scanned no image, and still reported the run green. Verified rather than reasoned: the latest scheduled run reports "Docker Image Scan: skipped" while Trivy FS, CodeQL and License Compliance all ran. api and agent carry the identical gate and behave the same way. A base-image CVE is precisely the class that appears with no code change, so excluding the image scan from the cron removed the only coverage that class had. Pull requests stay excluded on purpose: building the image on every PR costs minutes, and the filesystem Trivy scan already covers dependencies a PR introduces. Note the cron necessarily checks out the default branch, so the weekly image scan covers that branch only. Extending it needs an explicit second checkout and is a separate change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
docker-scanin.github/workflows/security.ymlwas gated on:The
scheduleevent is notpush, so the Monday cron skipped it — built noimage, scanned no image, and reported green anyway.
Verified rather than reasoned. The latest scheduled Security run:
The weekly cron exists to catch vulnerabilities disclosed since the last commit.
Base-image CVEs are exactly that class — they appear with no code change at
all. Excluding the image scan from the cron removed the only coverage they had.
All three repos with this job (api, ui, agent) carry the identical gate and all
three behave the same way. Companion PRs: api#380, plus one each for the
others.
The fix
maindevelopPull requests stay excluded deliberately — building the image on every PR costs
minutes, and the filesystem Trivy scan already covers dependencies a PR
introduces.
Known limit, stated rather than glossed
A
scheduleevent always checks out the default branch, so the weekly image scancovers that branch only. Extending it needs an explicit second checkout with an
Explicit
ref:, which is a separate change.Verification
.github/workflows/security.ymlparses as valid YAML; the new condition and theworkflow triggers were read back from the parsed document rather than eyeballed,
and the diff is confined to the comment block and the one
if:line.