chore(ci): 7-day grace period for newly published HIGH CVEs in Trivy scan - #836
Merged
Conversation
github-actions
Bot
force-pushed
the
chore/trivy-grace-period
branch
from
July 19, 2026 14:52
09fd39e to
13ea75d
Compare
manavgup
added a commit
that referenced
this pull request
Jul 19, 2026
…837) 'Postgres integration tests' is a required status check on main, but its workflow is path-filtered to src/tests/dependency paths. A PR touching none of those (workflow-only or docs-only changes) never gets the check reported and stays BLOCKED forever — this deadlocked #836 and #832 despite every triggered check passing. Add GitHub's documented mirror pattern: an identically named job that succeeds instantly, triggered by the exact inverse filter (paths-ignore mirroring the real workflow's paths). Code PRs run the real tests; non-code PRs get the green check from the mirror. This PR unblocks itself the same way. Co-authored-by: manavgup <manavgup@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Three times in four days a freshly published advisory failed the Trivy scan on code that was green at review time (#833's two rounds, then CVE-2026-52869 against mcp blocking the post-#833 deploy and #832). A hard fail-on-publish gate freezes every in-flight merge on findings unrelated to the change being merged. Add an OPA ignore policy: HIGH vulnerabilities published within the last 7 days are ignored, leaving a window to bump the dependency in an orderly PR. After 7 days the scan fails as before, so nothing can be ignored indefinitely. CRITICAL findings are never ignored, and findings without a parseable PublishedDate fail closed. Verified locally with trivy 0.70: the 7-day window still reports old HIGH CVEs on python:3.11-slim, and a test 10-year window suppresses them — confirming the rule keys on Severity + PublishedDate. Also add .trivyignore and .github/trivy/** to the workflow's path filters so editing scan-ignore rules re-triggers the scan. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
manavgup
force-pushed
the
chore/trivy-grace-period
branch
from
July 19, 2026 15:39
13ea75d to
8a6c88a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Trivy scan fails the build the moment a HIGH advisory is published — three times in four days, PRs that were green at review time went red at merge time on findings unrelated to their changes (#833 twice, then CVE-2026-52869/
mcpblocking both the post-#833 deploy on main and #832's checks). A hard fail-on-publish gate freezes every in-flight merge until an emergency dep-bump PR lands.Solution
An OPA ignore policy (
.github/trivy/ignore-policy.rego) wired into both scan steps:PublishedDatefail closed (still reported).Verification (local, trivy 0.70)
python:3.11-slim: the 2 known old HIGH CVEs are still reported → policy compiles, doesn't over-ignore.Severity+PublishedDate.Changes
.github/trivy/ignore-policy.rego— new policy.github/workflows/docker.yml—ignore-policy:on both scan steps (PR scan + weekly rebuild), Tier 3 header updated,.trivyignore+.github/trivy/**added to path filters so ignore-rule edits re-trigger the scanNotes
mcpadvisory is 1 day old, inside the grace window. fix(deps): upgrade mcp 1.27.1 -> 1.28.1 (CVE-2026-52869) #835 remains the real fix for that CVE and should merge regardless.Scan dependenciesstill surface it immediately; this only changes when the build gate trips.🤖 Generated with Claude Code