Rescan main dependencies and the production image daily #43

New issue

Open

opened 2026-11-01 20:12:00 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:12:00 +00:00

Owner

New advisories can affect unchanged code. Daily checks must examine current dependencies and the deployed production image without starting a deployment.

Scope

Add a daily Forgejo workflow that reuses the dependency and image vulnerability commands. Make results visible through existing CI reports.

Acceptance criteria

Each daily run identifies current main dependency lockfiles and the actual production image digest. It does not silently substitute a mutable tag.
Dependency and image vulnerability checks refresh advisory data. All vulnerability findings block regardless of severity or fix availability, unless an exact reviewed exception remains valid.
Exceptions require a reviewed reason, owner, and exact finding scope. Temporary acceptance of a real vulnerability expires within thirty days.
Expired exceptions, unavailable advisory data, missing required artifacts, and incomplete scans fail visibly.
The workflow does not deploy, rebuild production, change dependencies, or run active DAST against production.
Reports retain the scanned identities, findings, and execution failures with redacted values. The ordinary thirty-day report policy applies.
Results do not create a private operations notification channel. The initial workflow uses existing CI visibility.

Validation

Trigger the workflow manually against a controlled target and inspect the scheduled configuration. Cover a new advisory, expired exception, unavailable registry, and missing advisory data. Confirm no deployment operation is invoked.

Dependencies

#30: Block vulnerable dependencies and unsafe container configuration. Scheduled scans reuse the vulnerability and exception policy.
#36: Promote published releases without rebuilding their images. The rescan must resolve the current production image digest.

#42: Retain release images and redact CI evidence

New advisories can affect unchanged code. Daily checks must examine current dependencies and the deployed production image without starting a deployment. ## Scope Add a daily Forgejo workflow that reuses the dependency and image vulnerability commands. Make results visible through existing CI reports. ## Acceptance criteria - Each daily run identifies current `main` dependency lockfiles and the actual production image digest. It does not silently substitute a mutable tag. - Dependency and image vulnerability checks refresh advisory data. All vulnerability findings block regardless of severity or fix availability, unless an exact reviewed exception remains valid. - Exceptions require a reviewed reason, owner, and exact finding scope. Temporary acceptance of a real vulnerability expires within thirty days. - Expired exceptions, unavailable advisory data, missing required artifacts, and incomplete scans fail visibly. - The workflow does not deploy, rebuild production, change dependencies, or run active DAST against production. - Reports retain the scanned identities, findings, and execution failures with redacted values. The ordinary thirty-day report policy applies. - Results do not create a private operations notification channel. The initial workflow uses existing CI visibility. ## Validation Trigger the workflow manually against a controlled target and inspect the scheduled configuration. Cover a new advisory, expired exception, unavailable registry, and missing advisory data. Confirm no deployment operation is invoked. ## Dependencies - [#30: Block vulnerable dependencies and unsafe container configuration](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/30). Scheduled scans reuse the vulnerability and exception policy. - [#36: Promote published releases without rebuilding their images](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/36). The rescan must resolve the current production image digest. ## Related work - [#42: Retain release images and redact CI evidence](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/42)

viacheslavshuka added the

kind

area/tooling

size

labels

2026-11-01 20:13:59 +00:00

viacheslavshuka referenced this issue

2026-11-01 20:16:07 +00:00

Block vulnerable dependencies and unsafe container configuration #30

viacheslavshuka added a new dependency

2026-11-01 20:16:28 +00:00

#30 Block vulnerable dependencies and unsafe container configuration