Optional: pinned scanner image for the CVE scan runbook - #2144
Draft
NickJosevski wants to merge 1 commit into
Draft
Optional: pinned scanner image for the CVE scan runbook#2144NickJosevski wants to merge 1 commit into
NickJosevski wants to merge 1 commit into
Conversation
Nothing depends on this. scan.sh installs Trivy and Grype at runtime when they are
absent, which is why the runbook works without an image today.
That install is unpinned, and for a scheduled scan that is a real weakness: the runbook
alerts when the reported CVE set changes, so a silent scanner upgrade and a genuine new
CVE produce the same signal. Pinning turns scanner upgrades into reviewable commits.
Adopting it is a two-line container{} change in the runbook. scan.sh needs no change - it
detects the binaries on PATH and skips its install step.
The vulnerability databases are deliberately not baked in. They change daily, and a stale
database would produce a quiet clean result for the same reason an EOL runtime does.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Optional and additive. Nothing depends on this, and merging it changes no current
behaviour. Raised separately from
#2143 so it can be adopted whenever
it is wanted, or not at all.
The problem it solves
scripts/scan-calamari-cves/scan.shinstalls Trivy and Grype at runtime when they are noton
PATH. That is why the runbook works today with a stockworker-toolscontainer and noimage to maintain.
Those installs are unpinned, which matters only once the scan runs unattended:
Pinning makes scanner upgrades explicit, reviewable commits to a
Dockerfilerather thansomething that happens silently between two Wednesdays.
Adopting it
Dockerfileheader).container { feed, image }in the runbook's scan step — two lines inModern-Deployments/.octopus/calamari-cve-scanning/runbooks/scan-cves.ocl.scan.shauto-detects both binaries onPATHand skips its install step,so the same script still works locally with Docker and in the runbook without it.
Versions are pinned to
trivy 0.74.0/grype 0.117.0— the versions observed in the firstgreen runbook run on 2026-08-18.
What is deliberately not in the image
The vulnerability databases. They change daily — this repo's README records
CVE-2026-44788going from absent to present in the audit source within one day. A database frozen into an
image would report a clean, quiet result for the same reason an end-of-life runtime does:
because nobody is looking, not because nothing is wrong.
Both tools fetch the current database at run time. On Octopus Cloud dynamic workers there is
no cross-run cache anyway, so this costs nothing extra.