kevinveenbirkenbachandClaude Opus 5.5 4fa63dd1fb feat(security): keep one vulnerability issue per image and comment its unresolved CVEs ...

The dry-run mirror scan (run 41286420589) reported 10,179 CVE/image pairs
across 135 red digests; one issue per pair would flood the tracker. The
sync now keeps exactly one open issue per pinned image:

- The body lists every CVE row (id, severity, engine, role, service,
  package, installed, fixed), CRITICAL first, and stops below 60,000
  characters with the number of rows left out and a pointer to the
  vulnerability-findings artifact. On the dry-run data: 135 issues, 8
  capped, the largest body 59,872 characters.
- A further open issue with the same title closes as a duplicate of the
  oldest one.
- When an image's CVE table changed, the issue gets a "Still unresolved"
  comment with the table and an updated body; an unchanged table leaves the
  issue alone, so a daily run does not add 135 identical comments.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 17:48:08 +01:00

..

__init__.py

feat(sys-ctl-hlth-runtime): alert on EOL or unpatched PHP and missing PHP hardening

2026-10-29 00:12:25 +01:00

test_database.py

feat(ci): rotate the vulnerability engine per row and hand its databases over

2026-11-01 02:44:58 +01:00

test_issues.py

feat(security): keep one vulnerability issue per image and comment its unresolved CVEs

2026-11-01 17:48:08 +01:00

test_scan.py

fix(sys-ctl-hlth-runtime): scan with Trivy, Grype and OSV instead of PHP floors

2026-11-01 02:44:58 +01:00

test_summary.py

feat(ci): scan the mirrored images daily and track their CVEs as issues

2026-11-01 02:44:59 +01:00