Extend Trivy scanning with action recommendations - #981
Conversation
Run additional scan of latest base-image (if a newer one exists) to see if the vulnerability findings are fixed there. Use this reference to recommend mitigations - bump if patch exists and it fixes things, else do workaround or ignore
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📝 WalkthroughWalkthroughThis PR adds scripts for deriving Dockerfile base-image metadata and analyzing Trivy findings, fixture-based tests for both scripts, and workflow changes for inline scanning, SARIF conversion, base comparison, mitigation reporting, and conditional failure. ChangesBase image fix mitigation pipeline
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (3)
.github/workflows/container-scan.yml (3)
35-35: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSet
persist-credentials: falseon checkout.The checkout step doesn't disable credential persistence, so the ephemeral
GITHUB_TOKENremains in the local git config for the rest of the job (docker build, curl to external registries, etc.) even though nothing downstream needs to push back to the repo.🔒 Proposed fix
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/container-scan.yml at line 35, The checkout step in the container-scan workflow is leaving GitHub credentials persisted in the job environment. Update the existing actions/checkout usage in the workflow to set persist-credentials to false so the ephemeral GITHUB_TOKEN is not stored in local git config. Keep the change scoped to the checkout step in the workflow and ensure no downstream steps rely on repository push credentials.Source: Linters/SAST tools
34-41: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winWire
run-tests.shinto CI.The new fixture-based test harness (
.github/scripts/tests/run-tests.sh) isn't invoked anywhere in this workflow, so regressions inderive-base-image.sh/analyze-base-fixes.shwon't be caught automatically unless it's run elsewhere.✅ Proposed addition
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Run helper script tests + run: bash .github/scripts/tests/run-tests.sh🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/container-scan.yml around lines 34 - 41, The container scan workflow currently builds the image but never exercises the new fixture-based test harness, so regressions in derive-base-image.sh and analyze-base-fixes.sh can slip through. Update the container-scan job to invoke .github/scripts/tests/run-tests.sh as part of the existing steps, using the same checkout context and environment it needs, so the workflow validates the script behavior automatically alongside the Docker build.
37-38: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the Trivy CLI version in
setup-trivy.github/workflows/container-scan.yml:38aquasecurity/setup-trivydefaults tolatest, so the installed scanner can drift between runs. Set a fixedversioninput, e.g.v0.72.0, to keep scans reproducible.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/container-scan.yml around lines 37 - 38, The Trivy setup step in the container-scan workflow is relying on the default latest CLI, which can change between runs. Update the aquasecurity/setup-trivy action usage in the Install Trivy step to pass a fixed version input so the scanner stays reproducible, and keep the change anchored to the setup-trivy step in the workflow.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/container-scan.yml:
- Line 35: The checkout step in the container-scan workflow is leaving GitHub
credentials persisted in the job environment. Update the existing
actions/checkout usage in the workflow to set persist-credentials to false so
the ephemeral GITHUB_TOKEN is not stored in local git config. Keep the change
scoped to the checkout step in the workflow and ensure no downstream steps rely
on repository push credentials.
- Around line 34-41: The container scan workflow currently builds the image but
never exercises the new fixture-based test harness, so regressions in
derive-base-image.sh and analyze-base-fixes.sh can slip through. Update the
container-scan job to invoke .github/scripts/tests/run-tests.sh as part of the
existing steps, using the same checkout context and environment it needs, so the
workflow validates the script behavior automatically alongside the Docker build.
- Around line 37-38: The Trivy setup step in the container-scan workflow is
relying on the default latest CLI, which can change between runs. Update the
aquasecurity/setup-trivy action usage in the Install Trivy step to pass a fixed
version input so the scanner stays reproducible, and keep the change anchored to
the setup-trivy step in the workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d43e46e5-6fdd-4550-aac3-b2184fc3913d
📒 Files selected for processing (6)
.github/scripts/analyze-base-fixes.sh.github/scripts/derive-base-image.sh.github/scripts/tests/fixtures/app-findings.json.github/scripts/tests/fixtures/base-latest-findings.json.github/scripts/tests/run-tests.sh.github/workflows/container-scan.yml
to evaluate the severity of the finding and of the need for express release
| TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db | ||
| TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db | ||
| TRIVY_SHOW_SUPPRESSED: true |
There was a problem hiding this comment.
Moved from step.env to job.env to make the variables available for both scan steps. The original app-image scanning ("Run Trivy vulnerability scanner") + the new base image scanning ("Scan the latest base image")
|
@coderabbitai full review |
✅ Action performedFull review finished. Your plan includes PR reviews subject to rate limits. More reviews will be available in 52 minutes. |
✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/container-scan.yml (1)
95-122: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd timeouts to network calls to prevent workflow hangs.
Both
docker buildx imagetools inspect(line 98-99) andcurl(line 119-121) make network calls without explicit timeouts. If the registry or MCR API is slow or unresponsive, the step can hang until the job timeout. Thecurlhas|| truefor error tolerance, but that doesn't help if the command itself blocks indefinitely.⏱️ Proposed fix: add timeouts to both network calls
set -euo pipefail # Resolve the digest the floating tag points at right now (manifest # metadata only -- no image layers are pulled). - latest_digest=$(docker buildx imagetools inspect \ + latest_digest=$(timeout 30 docker buildx imagetools inspect \ "${BASE_REPO}:${FLOATING_TAG}" --format '{{.Manifest.Digest}}')- latest_version=$(curl -sfL --proto '=https' --proto-redir '=https' "https://mcr.microsoft.com/v2/${repo_path}/tags/list" \ + latest_version=$(curl -sfL --max-time 30 --proto '=https' --proto-redir '=https' "https://mcr.microsoft.com/v2/${repo_path}/tags/list" \ | jq -r --arg p "$pattern" '.tags[]? | select(test($p))' \ | sort -V | tail -n1 || true)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/container-scan.yml around lines 95 - 122, The workflow step that resolves the base image digest and latest version can hang because `docker buildx imagetools inspect` and the `curl` call in the same script have no explicit timeouts. Update the script in the container scan job to add bounded timeout options around both network operations, keeping the current `set -euo pipefail` and existing output behavior intact. Use the existing `latest_digest`, `latest_version`, and `has_new_base` logic as-is, but ensure `imagetools inspect` and the MCR tags request fail fast instead of waiting indefinitely.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/analyze-base-fixes.sh:
- Around line 82-88: The base-scan loading in analyze-base-fixes.sh does not
validate that base_json exists and contains valid JSON before populating
latest_base_ids, so a missing or broken scan can incorrectly mark all
base-origin findings as fixed. Update the base_json handling in the jq/while
block to explicitly check for a readable file and valid JSON before loading IDs,
and if validation fails, stop the “HAS_NEW_BASE=true” path from treating the
scan as loaded and leave base-origin findings classified as not yet fixed. Use
the latest_base_ids map and the HAS_NEW_BASE/base_json logic to locate the fix.
In @.github/scripts/derive-base-image.sh:
- Around line 45-47: The ref parsing in derive-base-image.sh currently strips
all whitespace after sed, which breaks FROM lines that include flags like
--platform. Update the logic around the ref assignment to ignore FROM flags
first and then capture the first non-flag token before any AS clause, so
BASE_REPO and BASE_TAG are derived from the actual image reference rather than a
flag string.
In @.github/workflows/container-scan.yml:
- Around line 35-40: The Install Trivy step in the container-scan workflow is
still relying on the setup-trivy default latest binary, which can change
behavior under the same pinned action version. Update the
aquasecurity/setup-trivy step to pass an explicit version input so the Trivy
binary is reproducible across runs, and keep the change localized to the Install
Trivy job step.
---
Nitpick comments:
In @.github/workflows/container-scan.yml:
- Around line 95-122: The workflow step that resolves the base image digest and
latest version can hang because `docker buildx imagetools inspect` and the
`curl` call in the same script have no explicit timeouts. Update the script in
the container scan job to add bounded timeout options around both network
operations, keeping the current `set -euo pipefail` and existing output behavior
intact. Use the existing `latest_digest`, `latest_version`, and `has_new_base`
logic as-is, but ensure `imagetools inspect` and the MCR tags request fail fast
instead of waiting indefinitely.
🪄 Autofix
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 84a917ae-6638-41fd-8ea5-0efdd75df0cb
📒 Files selected for processing (6)
.github/scripts/analyze-base-fixes.sh.github/scripts/derive-base-image.sh.github/scripts/tests/fixtures/app-findings.json.github/scripts/tests/fixtures/base-latest-findings.json.github/scripts/tests/run-tests.sh.github/workflows/container-scan.yml
Previously, the image ref wouldn't read correctly if new flags were to be added after FROM
latest_base_ids has a capture that strips trailing newline
|
|
Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
|
1 participant
Run additional scan of latest base-image (if a newer one exists) to see if the vulnerability findings are fixed there. Use this reference to recommend mitigations - bump if patch exists and it fixes things, else do workaround or ignore.
Relevant mitigations are given in the scan summary.
When app third-party deps with vulnerabilities are found, the mitigation is to update app dependencies in csproj (example).
When the OS image contains vulnerable libraries, the mitigation is to bump to newer image (if exists) or to await fix. (example)
SARIF upload seems to work as expected, opening new issues for unaddressed findings, and closing them when fixed or ignored.
Summary by CodeRabbit
Summary by CodeRabbit
New Features
Bug Fixes
Tests