kevinveenbirkenbachandClaude Opus 5.5 5e5e61d255 feat(ci): scan the mirrored images daily and track their CVEs as issues ...

The daily mirror workflow gains a scan job after the sync. It runs
make test-security against the GHCR mirror, writes the failing findings per
image and per CVE into the job summary and uploads the report as the
vulnerability-findings artifact.

- One issue per CVE and image, labelled vulnerability, is opened, updated
  while the finding stays and closed once no engine reports it. Issues are
  only closed when the scan reported no error, so an image that failed to
  scan keeps its issues.
- workflow_dispatch and workflow_call take an issues switch; false is a dry
  run that only produces the summary and the artifact. Scheduled runs always
  sync the issues.
- Only the scan job holds issues: write.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 02:44:59 +01:00

..

cli

feat(ci): scan the mirrored images daily and track their CVEs as issues

2026-11-01 02:44:59 +01:00

group_vars

fix(svc-prx-openresty): size worker_connections independently of pids_limit

2026-10-31 03:00:03 +01:00

library

fix(database_query): keep psql's command tags out of the returned rows

2026-10-22 20:36:32 +02:00

plugins

test(lookup): restore sys.modules after loading the sso plugins fresh

2026-10-31 02:17:21 +01:00

roles

fix(sys-ctl-hlth-runtime): scan with Trivy, Grype and OSV instead of PHP floors

2026-11-01 02:44:58 +01:00

scripts

fix(ci): check the PR head against the main it was tested with

2026-10-29 22:10:45 +01:00

utils

feat(ci): rotate the vulnerability engine per row and hand its databases over

2026-11-01 02:44:58 +01:00

__init__.py

…