ci: container image scan gate with Trivy (spec 013 G2) by ValgulNecron · Pull Request #678 · GameplanePanel/Gameplane

ValgulNecron · 2026-10-12T04:18:53Z

Before: CI built every component image but never scanned it, and publish-edge and release signed whatever they pushed.

After: a new vuln (images) job scans every gameplane-test/*:e2e image (plus api:e2e-postgres) from the build-images artifact and fails on any HIGH or CRITICAL vulnerability that has a fix. publish-edge and release run the same scan on each pushed digest before cosign sign, so an image with a fixed HIGH/CRITICAL finding is never signed.

How: hack/trivy-scan-images.sh runs trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 on each argument and fails after scanning them all. hack/check-image-scan_test.sh proves the gate: alpine:3.17.0 pinned by digest must fail and report CVE-2023-0286, and the telemetry-receiver e2e image must pass. Trivy v0.74.0 is installed through aquasecurity/setup-trivy v0.3.1, SHA-pinned; the Trivy DB is cached per ISO week. The job is registered in the CI report. G-02 moves to in progress; T031 (fixing the first run's findings) follows once this run shows them.

Builds on the spec 013 setup PR #671 (includes its commits until it merges).

🤖 Generated with Claude Code

Generated by Claude Code

Add hack/trivy-scan-images.sh (HIGH/CRITICAL, fixed only, scans every image before failing) and its proof hack/check-image-scan_test.sh, which must see an EOL alpine:3.17.0 rejected with CVE-2023-0286 and the telemetry-receiver e2e image accepted. New job vuln (images) scans every gameplane-test e2e image from the build-images artifact, with a weekly Trivy DB cache. publish-edge and release scan each pushed digest before cosign signs it. G-02 moves to in progress; T031 fixes the first run's findings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

coderabbitai · 2026-10-12T04:19:03Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: b35851f0-7b8e-4fb6-ae49-808697439258

📥 Commits

Reviewing files that changed from the base of the PR and between 28e39db and 5c07ace.

⛔ Files ignored due to path filters (6)

agent/go.sum is excluded by !**/*.sum
api/go.sum is excluded by !**/*.sum
go.work.sum is excluded by !**/*.sum
mcp-server/go.sum is excluded by !**/*.sum
sentinel/go.sum is excluded by !**/*.sum
tunnel/frpc/go.sum is excluded by !**/*.sum

📒 Files selected for processing (14)

.github/dependabot.yml
.github/workflows/ci.yaml
.github/workflows/publish-edge.yaml
.github/workflows/release.yaml
agent/go.mod
api/go.mod
hack/check-image-scan_test.sh
hack/trivy-scan-images.sh
mcp-server/go.mod
sentinel/go.mod
specs/013-expand-test-coverage/coverage-gaps.md
specs/013-expand-test-coverage/tasks.md
tunnel/Dockerfile.frp
tunnel/frpc/go.mod

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

ValgulNecron · 2026-10-12T04:33:28Z

vuln (images) is red on real findings in existing images. The gate itself works.

The proof passed: the EOL alpine was rejected and reported CVE-2023-0286, and telemetry-receiver was accepted. The scan then failed 8 of 12 images. Every finding has a fix:

golang.org/x/net v0.58.0 (v0.59.0 in capture-sidecar) has CVE-2026-78669 (HIGH), fixed in v0.60.0. This affects agent, api (both tags), capture-sidecar, mcp-server, operator and sentinel.
tunnel-frp fails on the upstream frpc binary (FRP_VERSION 0.70.1 in tunnel/Dockerfile.frp). It was built with Go 1.25.12, x/net v0.56.0 and x/crypto v0.54.0, which gives 12 HIGH findings. 0.71.0 is the latest frp release, but I haven't confirmed it carries the fixes.

T031 covers this: x/net bumps in the six go.mod files, and an frp version and checksum bump. These are dependency changes to production images, so I'm holding them until the maintainer signs off. The x/net bump overlaps with the G1 govulncheck findings on #673.

Generated by Claude Code

github-actions · 2026-10-12T04:57:48Z

CI Report - `5c07ace`

run 38323442610 - attempt 1

0 failed - 31 passed - 0 skipped - 97m44s elapsed

Coverage

Module	Measured	Gate	Margin
web	L95.53 S94.07 B88.79 F91.78	L92 S92 B82 F76	+2.07

Changed

Area	Files	+/-
tunnel/	3	+246/-24
hack/	2	+88/-0
.github/	4	+77/-1
mcp-server/	2	+17/-19
sentinel/	2	+12/-12
specs/	2	+9/-7
agent/	2	+3/-3
api/	2	+3/-3
(root)	1	+2/-0

Slowest jobs

Job	Duration
e2e telemetry / amd64 (kind)	23m38s
e2e telemetry / arm64 (kind)	23m18s
e2e capture overhead (kind)	13m8s
build e2e images	10m10s
e2e multicluster / arm64 (kind x2)	9m43s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, multicluster, operator, ratelimit, telemetry, upgrade

Signed-off-by: Claude <noreply@anthropic.com>

Trivy flagged CVE-2026-78669 (HIGH, fixed in v0.60.0) in the agent, api, mcp-server, operator and sentinel images. capture-sidecar already moved to v0.60.0 on master. go mod tidy pulled x/sync, x/sys, x/term and x/text forward as x/net v0.60.0 requires. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

ValgulNecron · 2026-10-12T17:48:29Z

The web check failed on 35553b5 in src/routes/Share.test.tsx › "T184: transitions to Up when server is Running" (Test timed out in 5000ms; 2760 of 2761 tests passed).

This PR doesn't change anything under web/ (git diff --stat master...claude/013-trivy -- web is empty), and web is green on the latest master run (38284594065). The test runs fake timers with shouldAdvanceTime: true and a synchronous advanceTimersByTime(5000) before a waitFor, so it races against real time on a loaded runner. No fix for it exists yet, and changing the test needs the maintainer's sign-off, so I'm re-running the failed job once instead of touching it here.

Generated by Claude Code

ValgulNecron · 2026-10-12T18:21:19Z

vuln (images) failed on 35553b5, the head before the x/net bump. It found 13 HIGH findings, two causes:

golang.org/x/net CVE-2026-78669 in agent, api, operator, mcp-server and sentinel. 422e6ec, now the head, bumps x/net to v0.60.0 in all five, so the scan running on it should clear these.
/usr/local/bin/frpc in tunnel-frp: the upstream frp release binary is built with go1.25.12, x/net v0.56.0 and x/crypto v0.54.0. No frp release is clean yet, so the fix needs tunnel/Dockerfile.frp to build frpc from source. That waits on the maintainer's go-ahead.

Generated by Claude Code

…spec 013 G2, T031) No frp release binary scans clean: 0.70.1 and 0.71.0 are both built with go1.25.12, x/net v0.56.0 and x/crypto v0.54.0, which carry fixed HIGH CVEs. The new tunnel/frpc module pins frp v0.71.0 with x/net v0.60.0 and x/crypto v0.58.0 (go.sum-verified) and mirrors frp's yamux replace; Dockerfile.frp compiles frpc from it with Go 1.27 and the upstream frpc,noweb tags (the supervisor never enables frpc's admin UI). Dependabot watches the new module. valgul chose "Build from source". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

…inistic Two T184 Share polling tests mixed shouldAdvanceTime fake timers with a synchronous advanceTimersByTime and waitFor, so they timed out on busy runners (#677, #678). They now use pure fake timers advanced with advanceTimersByTimeAsync inside act, like the newer T184 test in the same file. The CaptureWidget download-button test asserted the button was enabled before the capabilities query had resolved (#672, #684); it now waits for that. Assertions are unchanged. valgul chose "Fix in #677". Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

Signed-off-by: Claude <noreply@anthropic.com> # Conflicts: # operator/go.mod # operator/go.sum

Keep the from-source frpc build stage; master's pinned apk and pipefail lines belonged to the release-download stage it replaces. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

ValgulNecron added area: shared netguard, gameaction, gameproto, svcutil and other shared packages type: ci CI, workflows, or build tooling type: security Security hardening or vulnerability fix labels Oct 12, 2026 — with Claude

ValgulNecron self-assigned this Oct 12, 2026

claude added 2 commits October 12, 2026 17:30

Merge remote-tracking branch 'origin/master' into claude/013-trivy

35553b5

Signed-off-by: Claude <noreply@anthropic.com>

ValgulNecron mentioned this pull request Oct 12, 2026

test: unit coverage for managed secrets and console shell (spec 013 US4) #677

Merged

ValgulNecron mentioned this pull request Oct 12, 2026

fix(operator): verify module signatures with cosign v3 #684

Merged

claude added 2 commits October 12, 2026 20:57

Merge remote-tracking branch 'origin/master' into claude/013-trivy

62cf341

Signed-off-by: Claude <noreply@anthropic.com> # Conflicts: # operator/go.mod # operator/go.sum

chore: merge master into claude/013-trivy

00dd29e

Keep the from-source frpc build stage; master's pinned apk and pipefail lines belonged to the release-download stage it replaces. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

ValgulNecron marked this pull request as ready for review October 12, 2026 23:08

claude added 5 commits October 12, 2026 23:34

chore: merge master into claude/013-trivy

bcc029e

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

chore: merge master into claude/013-trivy

24ddde6

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

chore: merge master into claude/013-trivy

87c4fca

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

docs(specs): close 013 G-02 and tick T031

4d7729a

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

chore: merge master into claude/013-trivy

5c07ace

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>

Navigation Menu

Repository navigation

ci: container image scan gate with Trivy (spec 013 G2) - #678

ci: container image scan gate with Trivy (spec 013 G2)#678
ValgulNecron wants to merge 11 commits into
masterfrom
claude/013-trivy

ValgulNecron commented Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Review limit reached

Uh oh!

ValgulNecron commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

ValgulNecron commented Oct 12, 2026

Uh oh!

ValgulNecron commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ValgulNecron commented Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

ValgulNecron commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Report - 5c07ace

Coverage

Changed

Slowest jobs

e2e buckets run

Uh oh!

ValgulNecron commented Oct 12, 2026

Uh oh!

ValgulNecron commented Oct 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

github-actions Bot commented Oct 12, 2026 •

edited

Loading

CI Report - `5c07ace`