Block vulnerable dependencies and unsafe container configuration #30

New issue

Open

opened 2026-11-01 20:11:47 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:11:47 +00:00

Owner

Every dependency vulnerability and Trivy configuration finding must block unless an exact reviewed exception applies. An unavailable scanner or advisory source cannot count as a clean result.

Scope

Run uv audit across all Python groups and extras, Bun dependency auditing, Hadolint, and Trivy image/configuration scans. Provide reusable scan commands for CI, complete local checks, and release rescans.

Acceptance criteria

Every uv audit and frontend dependency vulnerability finding blocks, subject to a reviewed exact exception. Audits include all applicable dependency groups and extras.
Every Trivy vulnerability blocks, regardless of severity, classification, or fix availability. Every Trivy configuration finding also blocks.
Hadolint warnings and errors block. Informational and style findings remain visible.
Missing advisory data, failed downloads, tool errors, and incomplete scans fail. Report tool status separately from finding count.
Exceptions record an owner, reviewed reason, and exact finding scope. Temporary acceptance of a real vulnerability expires within thirty days.
Expired exceptions fail without manual rediscovery. Updating one dependency or image does not extend an unrelated exception.
Required runs refresh advisory data while executable scanner inputs remain pinned. CI does not automatically fix or upgrade dependencies.
Reports identify the dependency lockfiles and exact image digest under review. They preserve failure evidence and redact credentials.
The explicit complete local command can run these online checks. Mandatory offline commit hooks do not run online vulnerability audits.

Validation

Exercise representative low-severity, unclassified, no-fix, configuration, and Hadolint warning findings through policy fixtures. Cover expired and mismatched exceptions, unavailable advisory data, and a scanner error. Scan the actual built image when available.

Dependencies

#26: Package and serve the website and API from one image. Container scanning needs the actual image and Dockerfile.
#13: Enforce complete validation in the shared Forgejo runner flow. Scans must participate in the required CI result.

Every dependency vulnerability and Trivy configuration finding must block unless an exact reviewed exception applies. An unavailable scanner or advisory source cannot count as a clean result. ## Scope Run uv audit across all Python groups and extras, Bun dependency auditing, Hadolint, and Trivy image/configuration scans. Provide reusable scan commands for CI, complete local checks, and release rescans. ## Acceptance criteria - Every uv audit and frontend dependency vulnerability finding blocks, subject to a reviewed exact exception. Audits include all applicable dependency groups and extras. - Every Trivy vulnerability blocks, regardless of severity, classification, or fix availability. Every Trivy configuration finding also blocks. - Hadolint warnings and errors block. Informational and style findings remain visible. - Missing advisory data, failed downloads, tool errors, and incomplete scans fail. Report tool status separately from finding count. - Exceptions record an owner, reviewed reason, and exact finding scope. Temporary acceptance of a real vulnerability expires within thirty days. - Expired exceptions fail without manual rediscovery. Updating one dependency or image does not extend an unrelated exception. - Required runs refresh advisory data while executable scanner inputs remain pinned. CI does not automatically fix or upgrade dependencies. - Reports identify the dependency lockfiles and exact image digest under review. They preserve failure evidence and redact credentials. - The explicit complete local command can run these online checks. Mandatory offline commit hooks do not run online vulnerability audits. ## Validation Exercise representative low-severity, unclassified, no-fix, configuration, and Hadolint warning findings through policy fixtures. Cover expired and mismatched exceptions, unavailable advisory data, and a scanner error. Scan the actual built image when available. ## Dependencies - [#26: Package and serve the website and API from one image](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/26). Container scanning needs the actual image and Dockerfile. - [#13: Enforce complete validation in the shared Forgejo runner flow](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/13). Scans must participate in the required CI result. ## Related work - [#5: Configure shared offline commit checks](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/5) - [#7: Create the React application with locked frontend tooling](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/7) - [#36: Promote published releases without rebuilding their images](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/36) - [#43: Rescan main dependencies and the production image daily](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/43)

viacheslavshuka referenced this issue

2026-11-01 20:11:51 +00:00

Deploy validated main images to development #34

viacheslavshuka referenced this issue

2026-11-01 20:11:53 +00:00

Promote published releases without rebuilding their images #36

viacheslavshuka referenced this issue

2026-11-01 20:12:00 +00:00

Rescan main dependencies and the production image daily #43

viacheslavshuka added the

kind

area/tooling