Copa hardened fixes by bluvulture · Pull Request #260 · pimcore/docker

bluvulture · 2026-07-21T09:55:40Z

This pull request introduces robust retry logic for Trivy invocations in CI/CD scripts, adds a new script to generate a comprehensive CVE report from scan data, and improves test coverage for these changes. It also ensures image digests are tracked and reported for both plain and hardened images, and sets up the Trivy Java DB repository. These changes increase the reliability and traceability of vulnerability scanning and reporting in the release pipeline.

Reliability improvements (Trivy invocations):

Added .github/scripts/with-retry.sh, a helper script that retries a command with exponential backoff on failure, to handle transient CI issues.
Updated .github/scripts/scan-patch-gate.sh to invoke Trivy via with-retry.sh for all scans and SBOM generation, reducing flakiness in CI [1] [2] [3] [4].
Updated the release workflow (.github/workflows/release.yml) to use with-retry.sh for SBOM generation with Trivy.

CVE reporting and digest tracking:

Added .github/scripts/generate-cve-report.sh, which aggregates per-image scan data to produce a Markdown report of known CVEs, their status (fixed, residual, unpatched), and image digests.
The release workflow now records and stores plain and hardened image digests after pushing, improving traceability in reports [1] [2].

Test coverage:

Extended .github/scripts/tests/run.sh with tests for with-retry.sh (single-run, retry, and failure cases), and for generate-cve-report.sh (output correctness, digest handling, edge cases with multiple packages per CVE).
Added test fixtures for plain and hardened scan results and metadata to support new report and keying logic [1] [2] [3] [4] [5] [6] [7] [8].

Configuration:

Set the TRIVY_JAVA_DB_REPOSITORY environment variable in the release workflow for completeness.

Testing reliability:

Ensured tests for the scan gate use RETRY_MAX=1 so that with-retry.sh behaves identically to direct invocation during test runs.

Prevents the gcr-mirror 'trivy-java-db 404' that failed a plain-build leg: - Add TRIVY_JAVA_DB_REPOSITORY=ghcr.io/aquasecurity/trivy-java-db:1 (the Java-DB counterpart to the existing TRIVY_DB_REPOSITORY ghcr pin) so the Java DB no longer comes from the flaky gcr mirror. - New with-retry.sh (3 attempts, exponential backoff, retries on any non-zero exit) wrapping the Trivy calls (plain SBOM in release.yml; initial scan, gate scan, hardened SBOM in scan-patch-gate.sh). NOT Copa -- its failures are usually terminal (EOL distros), so retrying wastes minutes. Unit tests cover with-retry (success/retry-then-succeed/exhaust); gate tests run with RETRY_MAX=1 so behaviour is unchanged and fast. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…re tests

…urface jq errors

…atal gate) A Trivy scan failure in Collect (after retries) now omits that variant from this run's report with a ::warning::, instead of failing the leg. The images already published; the report is transparency, not a gate -- same best-effort stance as the severity gate. Non-destructive: no rmi, uploads/cleanup stay always(). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… no-data skip) If no cve-report-data_* artifacts match (or the download hiccups), the job no longer hard-fails before the 'no data this run -> exit 0' skip. Best-effort, consistent with the non-fatal report collection. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- Document the CI-generated docs/known-cves.md per-arch CVE/patch report (plain + hardened digests, Copa fixes, residual CVEs), stable-only. - Expand the SBOM paragraph with oras discover/pull examples for both registries (noting the docker.io/ prefix oras requires) and the sboms_* workflow artifact fallback when referrer attach is skipped.

…le sort Final-review (Fable) fixes: - release.yml: mkdir -p now includes cve-artifacts so a zero-artifact run reaches the 'no data -> exit 0' skip instead of failing on the find (download-artifact zero-match doesn't create the dir). [blocking] - generate-cve-report.sh: unique_by([.VulnerabilityID,.PkgName]) (array key) instead of bare string concat, so a digit-boundary id/package collision can't silently drop a CVE row. LC_ALL=C on both sorts for environment-independent byte-determinism. Tests pass; output verified byte-identical across runs; actionlint clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds resilient Trivy execution and automated per-architecture CVE reporting for release images.

Changes:

Adds retry handling for Trivy scans and SBOM generation.
Collects image digests and generates known-CVE reports.
Adds documentation, fixtures, and script tests.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`README.md`	Documents SBOM retrieval and CVE reports.
`docs/superpowers/specs/2026-07-16-known-cves-report-design.md`	Defines the CVE-report design.
`docs/superpowers/plans/2026-07-16-known-cves-report.md`	Provides the implementation plan.
`.github/workflows/release.yml`	Collects and publishes CVE report data.
`.github/scripts/with-retry.sh`	Adds exponential command retries.
`.github/scripts/scan-patch-gate.sh`	Applies retries to Trivy operations.
`.github/scripts/generate-cve-report.sh`	Renders the Markdown CVE report.
`.github/scripts/tests/run.sh`	Tests retries and report generation.
`v5.2-amd64.plain.json`	Plain-image CVE fixture.
`v5.2-amd64.hardened.json`	Hardened-image CVE fixture.
`v5.2-amd64.meta.json`	Published digest fixture.
`v5.2-debug-amd64.plain.json`	Unpatched CVE fixture.
`v5.2-debug-amd64.meta.json`	Unpublished hardened-image fixture.
`v5.2-multipkg-amd64.plain.json`	Multi-package CVE fixture.
`v5.2-multipkg-amd64.hardened.json`	Residual multi-package fixture.
`v5.2-multipkg-amd64.meta.json`	Multi-package digest fixture.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                    if [ "${GITHUB_REF_TYPE:-}" != "branch" ]; then
+                        echo "Not a branch run (ref_type=${GITHUB_REF_TYPE:-unknown}); skipping known-cves.md commit."
+                        exit 0


+                        _ci/.github/scripts/with-retry.sh trivy image --format json -o "cve-report-data/${TAG}.plain.json" "${PLAIN_IMAGE}" \
+                            || { echo "::warning::CVE report: plain scan failed for ${imageVariant}; omitting it from this run's report"; rm -f "cve-report-data/${TAG}.plain.json"; continue; }


+            | .[] | [.VulnerabilityID,.Severity,.PkgName,.InstalledVersion,(.FixedVersion//"?")] | @tsv
+        ' "$plain_json")"
+        while IFS=$'\t' read -r id sev pkg old new; do
+            [ -z "$id" ] && continue
+            rows+="$(sev_rank "$sev")0"$'\t'"| \`${image}\` | ${arch} | \`${pd_short}\` | ${id} | ${sev} | ${pkg} | ✅ fixed · ${old} → ${new} |"$'\n'


    REPORT_TXT="${REPORT_DIR}/${TAG}-hardened_${IMAGE_HASH}.txt"

-    trivy image --pkg-types os --ignore-unfixed --severity "$GATE_SEVERITY" \
+    "${HERE}/with-retry.sh" trivy image --pkg-types os --ignore-unfixed --severity "$GATE_SEVERITY" \


+**Status:** **Parked** — design approved and a full implementation plan written
+(`docs/superpowers/plans/2026-07-16-known-cves-report.md`); **not yet implemented**.
+Pick up by executing that plan. Builds on the `publish_hardened` / push-digest work.


+            -   name: Collect CVE report data
+                if: ${{ matrix.build.hardened }}


bluvulture and others added 10 commits July 21, 2026 10:18

Un-park Known-CVEs report spec + plan (implementing now)

d76a122

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add known-CVEs report generator (fixed/residual, per-arch) with fixtu…

1a26df4

…re tests

generate-cve-report: key fixed-CVE detection on id+package (exact), s…

70592e3

…urface jq errors

release.yml: capture push digests and collect per-image CVE report data

3fb1c9d

release.yml: add publish-cve-report job committing docs/known-cves.md

ef4a324

Copilot AI review requested due to automatic review settings July 21, 2026 09:55

bluvulture requested a review from berfinyuksel as a code owner July 21, 2026 09:55

Copilot started reviewing on behalf of bluvulture July 21, 2026 09:56 View session

bluvulture requested a review from brusch July 21, 2026 09:56

Copilot AI reviewed Jul 21, 2026

View reviewed changes

bluvulture mentioned this pull request Jul 22, 2026

Trivy reporting vulnerabilities on Pimcore image #228

Closed

bluvulture self-assigned this Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Copa hardened fixes#260

Copa hardened fixes#260
bluvulture wants to merge 10 commits into
5.xfrom
copa-hardened-fixes

bluvulture commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		_ci/.github/scripts/with-retry.sh trivy image --format json -o "cve-report-data/${TAG}.plain.json" "${PLAIN_IMAGE}" \
		\|\| { echo "::warning::CVE report: plain scan failed for ${imageVariant}; omitting it from this run's report"; rm -f "cve-report-data/${TAG}.plain.json"; continue; }

		- name: Collect CVE report data
		if: ${{ matrix.build.hardened }}

Uh oh!

Conversation

bluvulture commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants