The make test-security report now holds every finding at the threshold, a
suppressed one with its suppressed_until day, and the scan fails only on the
unsuppressed rows. The per-image issue keeps listing a suppressed CVE with
that day, unsuppressed and CRITICAL rows first, so the issue stays open
while a suppression runs instead of closing until it expires. The job
summary counts the failing findings and names the suppressed total apart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The daily mirror workflow gains a scan job after the sync. It runs
make test-security against the GHCR mirror, writes the failing findings per
image and per CVE into the job summary and uploads the report as the
vulnerability-findings artifact.
- One issue per CVE and image, labelled vulnerability, is opened, updated
while the finding stays and closed once no engine reports it. Issues are
only closed when the scan reported no error, so an image that failed to
scan keeps its issues.
- workflow_dispatch and workflow_call take an issues switch; false is a dry
run that only produces the summary and the artifact. Scheduled runs always
sync the issues.
- Only the scan job holds issues: write.
Part of #1324
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5.5