Repository navigation
feat: add SBOM and vulnerability scans for pinned runtime container images - #15657
Merged
Merged
Conversation
…mages (#15656) A new Runtime image security workflow (weekly, on demand, and on PRs touching the recipes; not part of CI Gate) builds or pulls the pgvector and SuperCollider images on native amd64 and arm64 runners, generates a syft SBOM and a grype scan including OS packages, and uploads both with provenance (image, digest, recipe hash, commit, architecture, scanner and DB identity). Scanner errors or empty or malformed output fail the run instead of reading as zero findings. The inline Rapier npm pin is scanned too; the externally built eidoverse render parent and its deno.lock are reported as unavailable with the owning project. The scheduled dependency-updates prompt (v11) now consumes this evidence or names the gap.
atomantic
added
implementer:sonnet-5-5
reviewer:gpt-6-1-terra
GitHub rejected the workflow file because the runner context is not available in job-level env.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
Runtime image securityworkflow that produces an SBOM (syft) and a vulnerability scan (grype, OS packages and language deps) for the pinned runtime recipes the npm/Python audits cannot see.scripts/runtime-image-security.js(no second copy of a digest): the digest-pinned pgvector image indocker-compose.yml(amd64 + arm64, pulled by digest),docker/supercollider/(built with the product's own build argv, amd64 + arm64 on native runners), and the inlinenpm:@dimforge/rapier3d-compat@0.14.0pin from the eidoverse-video recipe.findings.jsonandprovenance.json(image ref/ID/repo digests, recipe path and hash, commit, run, architecture, tool versions, DB identity).CI Gate. Triggers: weekly schedule,workflow_dispatch, and PRs touching the recipes. Scheduled/dispatched runs are strict (fail on findings with no reviewed disposition indocker/runtime-image-security.reviews.json); PR runs only report, so an upstream advisory never blocks an unrelated PR.eidoverse:renderparent and its externaldeno.json/deno.lockare reported as unavailable (owning project named) in every run's summary and an artifact; never a pass.dependency-updatesprompt (v11, integrity snapshot regenerated) now consumes this evidence (run age <= 14 days, recipe/digest match) or names the coverage gap.docs/GITHUB_ACTIONS.md(new section), pointer fromdocs/SUPERCOLLIDER.md. Existing digest/version guards and the Debian snapshot are untouched.Test plan
scripts/runtime-image-security.test.js(15 tests): derivation from the real recipes (including thePINNED_DB_IMAGEpin) and refusal of an unpinned recipe, fail-closed SBOM/scan validation, review scoping (target/package/version/arch),verifyRunprovenance + strict exit, the unavailable report, and a workflow contract (not in CI Gate, SHA-pinned actions, checksummed scanners, every target x architecture on a native runner, validation before upload).npm run pregatepasses on the final head. Workflow YAML parsed, andactionlintis clean after the fix commit.Closes #15656
First hosted scan
The first push left GitHub rejecting the workflow file:
runner.tempwas used in job-levelenv, where therunnercontext is not available. Commit 9680328 setsEVIDENCE_DIRinside a step instead, andactionlintis now clean. The PR run that followed (run 42849197306) passed all 6 jobs and uploaded valid evidence for each target and architecture:Follow-ups
eidoverse:renderparent anddeno.lock) is reported as unavailable in every run, with the owning project named, as the issue's acceptance criteria allow.actionlintto CI and pregate, so an invalid workflow like the first push here fails before merge.Local review
2 of 2 rounds run with
gpt-6.1-terra. Round 1 (at 48a2d35) had 3 findings, all accepted and fixed (review scope by version/arch with no "fixed" suppression, ledger test, evidence age bound). Round 2 (at 3ece657) had 1 finding (record the eidoverse recipe hash in provenance), accepted and fixed in the final head without a third review. Statuspartial. The orchestrator's later one-line workflow fix (9680328) was validated by actionlint and the hosted run, not by the local reviewer.