fix: remediate critical and high CVEs in codecov-slack-app image

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  setup-build-publish:
+    name: Build and Push
+    runs-on: ubuntu-latest
+    environment: staging
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Enable experimental docker
+        run: |
+          sudo bash -c 'echo "{\"experimental\": true}" > /etc/docker/daemon.json'
+          sudo systemctl restart docker
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - id: auth
+        name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v0.6.0
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ secrets.CODECOV_GCP_WIDP }}
+          service_account: ${{ secrets.CODECOV_GCP_WIDSA }}
+
+      - name: Docker configuration
+        run: |-
+          echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev
+
+      - name: Build
+        env:
+          ENV: ci
+        run: |-
+          make build-requirements
+          make build
+
+      - name: Publish
+        env:
+          ENV: ci
+        run: |-
+          make push

Dockerfile

@@ -1,13 +1,21 @@
 # syntax=docker/dockerfile:1.3
 ARG REQUIREMENTS_IMAGE
-ARG BERGLAS_VERSION=2.0.8
-FROM            us-docker.pkg.dev/berglas/berglas/berglas:$BERGLAS_VERSION as berglas
+ARG BERGLAS_VERSION=v2.0.14
+ARG GO_IMAGE=golang:1.26-bookworm
+
+# Build berglas from source: the prebuilt image lags on Go stdlib and
+# golang.org/x/crypto, which carry the critical SSH CVEs in AR scans.
+FROM ${GO_IMAGE} as berglas
+ARG BERGLAS_VERSION
+RUN git clone --depth 1 --branch ${BERGLAS_VERSION} \
+    https://github.com/GoogleCloudPlatform/berglas.git /src
+WORKDIR /src
+RUN go get golang.org/x/crypto@v0.54.0 golang.org/x/net@v0.57.0 && go mod tidy
+RUN CGO_ENABLED=0 go build -trimpath -o /bin/berglas .
 
 FROM $REQUIREMENTS_IMAGE
 
-# Set working directory
 WORKDIR /app
-COPY            --chmod=755 --from=berglas /bin/berglas /usr/local/bin/berglas
-
+COPY --chmod=755 --from=berglas /bin/berglas /usr/local/bin/berglas
 
 COPY . /app/

Dockerfile.requirements

@@ -4,6 +4,7 @@
 FROM            python:3.12-alpine3.21 as build
 
 RUN             apk update \
+                && apk upgrade --no-cache \
                 && apk add --update --no-cache \
                 git \
                 openssh \
@@ -19,20 +20,20 @@ RUN             apk update \
                 build-base \
                 cargo \
                 curl-dev \
-                && pip install --upgrade pip
+                && pip install --upgrade 'pip>=26.1.2' setuptools
 
 COPY            requirements.txt /
 WORKDIR         /pip-packages/
 
 RUN             pip wheel -r /requirements.txt
-RUN             pip install --upgrade setuptools pip --break-system-packages;
 
 # RUNTIME STAGE - Copy packages from build stage and install runtime dependencies
 FROM            python:3.12-alpine3.21
 
-RUN             apk -U upgrade binutils busybox expat libretls && \
-                apk add --no-cache postgresql-libs && \
-                apk add --no-cache --virtual .build-deps gcc \
+RUN             apk update && apk upgrade --no-cache \
+                && apk add --no-cache postgresql-libs \
+                && apk add --no-cache --virtual .build-deps \
+                gcc \
                 musl-dev \
                 postgresql-dev \
                 libxslt-dev \
@@ -47,11 +48,11 @@ RUN             apk -U upgrade binutils busybox expat libretls && \
 WORKDIR         /pip-packages/
 COPY            --from=build /pip-packages/ /pip-packages/
 
-RUN             rm -rf /pip-packages/src
-RUN             pip install --no-deps --no-index --find-links=/pip-packages/ /pip-packages/*
-RUN             pip install --upgrade setuptools pip --break-system-packages;
+RUN             rm -rf /pip-packages/src \
+                && pip install --no-deps --no-index --find-links=/pip-packages/ /pip-packages/* \
+                && pip install --upgrade 'setuptools>=82' 'pip>=26.1.2' --break-system-packages \
+                && rm -rf /usr/local/lib/python3.12/ensurepip/_bundled/pip-*.whl \
+                && apk del .build-deps
 
-# Currently expat will not bump to latest if this upgrade is done earlier
-# https://unix.stackexchange.com/questions/769209/unable-to-install-or-upgrade-to-specific-version-of-alpine-expat-2-6-0-r0-in-alp
+# expat must be upgraded after .build-deps removal; see alpine#15709
 RUN             apk add --upgrade expat
-

requirements.in

@@ -1,14 +1,15 @@
-Django
+Django>=5.1,<5.2
 asgiref
-django-csp
+django-csp>=3.8,<4
 djangorestframework
 gunicorn
 httpx
 psycopg2-binary
-pyjwt
+pyjwt>=2.13.0
 pytest-django
 requests
 sentry-sdk
 slack-sdk
 slack_bolt
 sqlparse
+urllib3>=2.7.0

requirements.txt

@@ -1,80 +1,81 @@
 #
-# This file is autogenerated by pip-compile with Python 3.11
+# This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile
+#    pip-compile --output-file=requirements.txt requirements.in
 #
-anyio==3.7.0
+anyio==4.14.2
     # via httpx
-asgiref==3.7.2
+asgiref==3.12.1
     # via
     #   -r requirements.in
     #   django
-certifi==2024.7.4
+certifi==2026.6.17
     # via
     #   httpcore
     #   httpx
     #   requests
     #   sentry-sdk
-charset-normalizer==3.1.0
+charset-normalizer==3.4.9
     # via requests
-django==5.0.14
+django==5.1.15
     # via
     #   -r requirements.in
     #   django-csp
     #   djangorestframework
-django-csp==3.7
+django-csp==3.8
     # via -r requirements.in
-djangorestframework==3.15.2
+djangorestframework==3.17.1
     # via -r requirements.in
-gunicorn==23.0.0
+gunicorn==26.0.0
     # via -r requirements.in
 h11==0.16.0
     # via httpcore
 httpcore==1.0.9
     # via httpx
-httpx==0.25.1
+httpx==0.28.1
     # via -r requirements.in
-idna==3.7
+idna==3.18
     # via
     #   anyio
     #   httpx
     #   requests
-iniconfig==2.0.0
+iniconfig==2.3.0
     # via pytest
-packaging==23.1
+packaging==26.2
     # via
     #   gunicorn
     #   pytest
-pluggy==1.0.0
+pluggy==1.6.0
     # via pytest
-psycopg2-binary==2.9.6
+psycopg2-binary==2.9.12
     # via -r requirements.in
-pyjwt==2.7.0
+pygments==2.20.0
+    # via pytest
+pyjwt==2.13.0
     # via -r requirements.in
-pytest==7.3.1
+pytest==9.1.1
     # via pytest-django
-pytest-django==4.5.2
+pytest-django==4.12.0
     # via -r requirements.in
-requests==2.32.4
+requests==2.34.2
     # via -r requirements.in
-sentry-sdk==2.8.0
+sentry-sdk==2.65.0
     # via -r requirements.in
-slack-bolt==1.18.0
+slack-bolt==1.29.0
     # via -r requirements.in
-slack-sdk==3.21.3
+slack-sdk==3.43.0
     # via
     #   -r requirements.in
     #   slack-bolt
-sniffio==1.3.0
-    # via
-    #   anyio
-    #   httpx
-sqlparse==0.5.0
+sqlparse==0.5.5
     # via
     #   -r requirements.in
     #   django
-urllib3==1.26.19
+typing-extensions==4.16.0
+    # via anyio
+urllib3==2.7.0
     # via
+    #   -r requirements.in
     #   requests
     #   sentry-sdk