Homelab/workflows
Homelab/workflows
Watch
5
0
Fork
You've already forked workflows
 0
Code Issues 7 Pull requests Projects Releases 95 Packages Wiki Activity Actions

feat(security): carry reviewed image CVEs across builds #54

Merged
gitchegumi merged 1 commit from kiyi/stable-image-vulnerability-mitigations into main 2026-09-23 21:07:08 -05:00
Conversation 1 Commits 1 Files changed 6 +136 -28
kiyi commented 2026-09-23 20:57:04 -05:00
Member
Copy link

Comfy-UI run 176 repeated 224 already-reviewed OS package CVE findings under new build fingerprints. This adds an optional mitigation selector pinned to CVE, package, installed version, component class/type, image repository, and severity, so only an unchanged finding carries across build hashes and image digests. Exact fingerprint behavior remains for image secrets and other findings; new or changed CVEs still block.

Validation: 21 security tests and 7 reporting tests passed. Replaying run 176 with the paired Comfy-UI policy mitigated the 224 previously reviewed vulnerabilities and left 8 new vulnerabilities plus 22 image secret findings blocking. The full suite has unrelated Windows ClamAV socket and Bash runner canary failures (4 failures, 2 errors).

Related: Homelab/Comfy-UI#1. Release this library as v1.17.0 before merging the paired Comfy-UI caller pins.

Comfy-UI run 176 repeated 224 already-reviewed OS package CVE findings under new build fingerprints. This adds an optional mitigation selector pinned to CVE, package, installed version, component class/type, image repository, and severity, so only an unchanged finding carries across build hashes and image digests. Exact fingerprint behavior remains for image secrets and other findings; new or changed CVEs still block. Validation: 21 security tests and 7 reporting tests passed. Replaying run 176 with the paired Comfy-UI policy mitigated the 224 previously reviewed vulnerabilities and left 8 new vulnerabilities plus 22 image secret findings blocking. The full suite has unrelated Windows ClamAV socket and Bash runner canary failures (4 failures, 2 errors). Related: Homelab/Comfy-UI#1. Release this library as v1.17.0 before merging the paired Comfy-UI caller pins.
feat(security): carry reviewed image CVEs across builds
All checks were successful
Workflow acceptance / acceptance (pull_request) Successful in 2m2s
Details
Library checks / tests (pull_request) Successful in 2m59s
Details
Repository security / security-1 (pull_request) Successful in 7m37s
Details
Repository security / security (pull_request) Successful in 0s
Details
fceff8985e
gitchegumi approved these changes 2026-09-23 21:07:04 -05:00
gitchegumi deleted branch kiyi/stable-image-vulnerability-mitigations 2026-09-23 21:07:08 -05:00
Sign in to join this conversation.
Reviewers
No reviewers
gitchegumi
Labels
Clear labels
  
app-migration

   
bug
Something is not working

  
ci-cd

   
cluster

   
Documentation

   
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
gpu

   
invalid
Something is wrong

  
networking

   
question
More information is needed

  
security

   
Storage

   
wontfix
This won't be fixed

No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Homelab/workflows!54
No description provided.