fix(security): classify Dockerfile findings and require final-image ClamAV #57

Closed

kiyi wants to merge 2 commits from kiyi/source-dockerfile-findings into main

kiyi commented

2026-09-24 15:40:39 -05:00

Member

The manual base-images build in run #14 stops in source scanning because Trivy reports a Dockerfile absence finding without StartLine. This change gives source Dockerfile/general findings a stable target-scoped identity. HIGH findings remain blocking; unrelated line-less IaC still fails closed.

For the final exported container, publication now requires a fresh completed ClamAV scan. Signature-update or image-scan errors fail the publication gate and retain the scan evidence. Generic security scans keep their existing ClamAV warning behavior.

Validation: 47 focused scanner and publication tests passed locally. The broader suite has unrelated Windows-specific failures and is running in Linux CI. Tracks #56.

The manual base-images build in [run #14](https://git.gitchegumi.com/Homelab/base-images/actions/runs/14/jobs/0/attempt/1) stops in source scanning because Trivy reports a Dockerfile absence finding without StartLine. This change gives source Dockerfile/general findings a stable target-scoped identity. HIGH findings remain blocking; unrelated line-less IaC still fails closed. For the final exported container, publication now requires a fresh completed ClamAV scan. Signature-update or image-scan errors fail the publication gate and retain the scan evidence. Generic security scans keep their existing ClamAV warning behavior. Validation: 47 focused scanner and publication tests passed locally. The broader suite has unrelated Windows-specific failures and is running in Linux CI. Tracks #56.

kiyi added 1 commit

2026-09-24 15:40:39 -05:00

fix(security): retain line-less source Dockerfile findings

Library checks / tests (pull_request) Successful in 2m36s

Details

Workflow acceptance / acceptance (pull_request) Successful in 5m55s

Details

Repository security / security (pull_request) Has been cancelled

Details

Repository security / security-1 (pull_request) Has been cancelled

Details

1249ecedd8

Treat Trivy Dockerfile absence checks in source scans as target-scoped findings. HIGH findings still block publication; unrelated line-less IaC remains a scanner error.

Tests: targeted Dockerfile identity and blocking tests passed locally.

kiyi added 1 commit

2026-09-24 15:46:48 -05:00

fix(security): require completed ClamAV scan for published images

Workflow acceptance / acceptance (pull_request) Successful in 3m3s

Details

Repository security / security-1 (pull_request) Successful in 3m34s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 6m7s

Details

28aaddc437

Require a fresh completed final-image ClamAV scan for the container publication path. Incomplete signature updates or image scans now fail the publication gate, while generic security scans retain their existing warning behavior.

Validation: 47 focused tests passed locally.

kiyi changed title from ~~fix(security): retain line-less source Dockerfile findings~~ to fix(security): classify Dockerfile findings and require final-image ClamAV

2026-09-24 15:50:28 -05:00

kiyi referenced this pull request

2026-09-24 15:52:02 -05:00

Handle Trivy Dockerfile findings without a source StartLine #56