kevinveenbirkenbachandClaude Opus 5.5 5e5e61d255 feat(ci): scan the mirrored images daily and track their CVEs as issues ...

The daily mirror workflow gains a scan job after the sync. It runs
make test-security against the GHCR mirror, writes the failing findings per
image and per CVE into the job summary and uploads the report as the
vulnerability-findings artifact.

- One issue per CVE and image, labelled vulnerability, is opened, updated
  while the finding stays and closed once no engine reports it. Issues are
  only closed when the scan reported no error, so an image that failed to
  scan keeps its issues.
- workflow_dispatch and workflow_call take an issues switch; false is a dry
  run that only produces the summary and the artifact. Scheduled runs always
  sync the issues.
- Only the scan job holds issues: write.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 02:44:59 +01:00

..

__init__.py

feat(sys-ctl-hlth-runtime): alert on EOL or unpatched PHP and missing PHP hardening

2026-10-29 00:12:25 +01:00

test_database.py

feat(ci): rotate the vulnerability engine per row and hand its databases over

2026-11-01 02:44:58 +01:00

test_issues.py

feat(ci): scan the mirrored images daily and track their CVEs as issues

2026-11-01 02:44:59 +01:00

test_scan.py

fix(sys-ctl-hlth-runtime): scan with Trivy, Grype and OSV instead of PHP floors

2026-11-01 02:44:58 +01:00

test_summary.py

feat(ci): scan the mirrored images daily and track their CVEs as issues

2026-11-01 02:44:59 +01:00