Repository navigation
ci: auto-rebuild :latest when the scheduled Trivy re-scan finds fixable CVEs - #42
Merged
Merged
Conversation
…le CVEs The weekly re-scan of the published image now hands findings to the existing Trivy-gated build workflow (workflow_call) instead of just failing: rebuild main at the current release version, then re-scan :latest to verify. Green = clean or self-healed; red = the rebuild's own gate refused to publish (fix not shipped upstream yet) or the verify scan still finds issues. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V1N3WEHKpJf9G3hN7H298o
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The weekly
Securityre-scan of the published:latestnow self-heals instead of just going red.New flow (schedule / manual dispatch only — nothing changes on PRs or pushes):
:latestas before, but findings no longer fail the run directly (continue-on-erroron the scan step).workflow_call) to rebuild main at the current release version — the OS-package upgrade in the build pulls the patched packages, and the build's own Trivy gate still blocks the push if the fix isn't actually published upstream yet.:latestto verify.Result: green run = clean or self-healed; red run = human attention genuinely needed (fix not shipped by the distro yet, or the rebuild didn't clear it).
Context: this morning's batch failure across all four repos (OpenSSL CVE-2026-14456 in unchanged base-image packages) — the class of finding Renovate structurally can't see, which previously needed a manual rebuild.
The new
rebuild/verifyjobs are schedule-only and must never be added to required checks.🤖 Generated with Claude Code
https://claude.ai/code/session_01V1N3WEHKpJf9G3hN7H298o