From c06f6b8eced1a8d16d82c3ba72332cc62441bbd6 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Mon, 11 May 2026 09:48:07 -0700 Subject: [PATCH 1/7] dont block ci Co-authored-by: Copilot --- .github/workflows/kafka-connect-cve-scan.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/kafka-connect-cve-scan.yml b/.github/workflows/kafka-connect-cve-scan.yml index 5781ed601163..2bbdd821bfe2 100644 --- a/.github/workflows/kafka-connect-cve-scan.yml +++ b/.github/workflows/kafka-connect-cve-scan.yml @@ -91,14 +91,14 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 + - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 with: distribution: zulu java-version: 21 - - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle + - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle - name: Build Kafka Connect distribution for scanning run: | ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions=3 \ @@ -117,7 +117,7 @@ jobs: scanners: 'vuln' severity: 'HIGH,CRITICAL' limit-severities-for-sarif: true - exit-code: '1' + exit-code: '0' format: 'sarif' output: 'trivy-results.sarif' - name: Print Trivy scan results From 9a0cec9f4cb6a2031a64d971a758cb8ea476cd3e Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Mon, 11 May 2026 09:53:17 -0700 Subject: [PATCH 2/7] only run on main Co-authored-by: Copilot --- .github/workflows/kafka-connect-cve-scan.yml | 51 ++------------------ 1 file changed, 5 insertions(+), 46 deletions(-) diff --git a/.github/workflows/kafka-connect-cve-scan.yml b/.github/workflows/kafka-connect-cve-scan.yml index 2bbdd821bfe2..cc753cfb9712 100644 --- a/.github/workflows/kafka-connect-cve-scan.yml +++ b/.github/workflows/kafka-connect-cve-scan.yml @@ -27,63 +27,22 @@ on: - '2.*' tags: - 'apache-iceberg-**' - pull_request: - paths-ignore: - - '.github/ISSUE_TEMPLATE/**' - - '.github/workflows/api-binary-compatibility.yml' - - '.github/workflows/delta-conversion-ci.yml' - - '.github/workflows/docs-ci.yml' - - '.github/workflows/flink-ci.yml' - - '.github/workflows/hive-ci.yml' - - '.github/workflows/java-ci.yml' - - '.github/workflows/jmh-benchmarks-ci.yml' - - '.github/workflows/labeler.yml' - - '.github/workflows/license-check.yml' - - '.github/workflows/open-api.yml' - - '.github/workflows/publish-snapshot.yml' - - '.github/workflows/recurring-jmh-benchmarks.yml' - - '.github/workflows/site-ci.yml' - - '.github/workflows/spark-ci.yml' - - '.github/workflows/kafka-connect-ci.yml' - - '.github/workflows/stale.yml' - - '.gitignore' - - '.asf.yaml' - - 'dev/**' - - 'docker/**' - - 'mr/**' - - 'flink/**' - - 'spark/**' - - 'docs/**' - - 'site/**' - - 'open-api/**' - - 'format/**' - - '.gitattributes' - - '**/README.md' - - 'CONTRIBUTING.md' - - '**/LICENSE' - - '**/NOTICE' - - 'doap.rdf' permissions: contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} + cancel-in-progress: false jobs: # ------------------------------------------------------------------ # Trivy CVE scan — scans bundled jars for known vulnerabilities. # - # Behaviour: - # - If a CVE is found, the step will fail. However, since this job - # is not a required check, it will not block merging. - # - On push to main/release branches: results are uploaded as - # SARIF to the GitHub Security tab for ongoing tracking. - # - On PRs: SARIF upload is skipped because GitHub's Security - # tab only accepts results from default/protected branches. - # CVE findings are visible in the CI log output instead. + # Runs on push to main/release branches only (not PRs). Results are + # uploaded as SARIF to the GitHub Security tab for ongoing tracking. + # The scan is informational and does not block the build. # ------------------------------------------------------------------ kafka-connect-cve-scan: runs-on: ubuntu-24.04 @@ -130,7 +89,7 @@ jobs: echo "No SARIF file found — scan may have failed to install." fi - name: Upload Trivy results to GitHub Security tab - if: always() && github.event_name == 'push' + if: always() uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: sarif_file: 'trivy-results.sarif' From b77d6507d9adf8848aa5fd6607be9ded5c1ce25a Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Mon, 11 May 2026 12:04:48 -0700 Subject: [PATCH 3/7] block on pr --- .github/workflows/kafka-connect-cve-scan.yml | 51 +++++++++++++++++--- 1 file changed, 45 insertions(+), 6 deletions(-) diff --git a/.github/workflows/kafka-connect-cve-scan.yml b/.github/workflows/kafka-connect-cve-scan.yml index cc753cfb9712..0b58949458b3 100644 --- a/.github/workflows/kafka-connect-cve-scan.yml +++ b/.github/workflows/kafka-connect-cve-scan.yml @@ -27,22 +27,60 @@ on: - '2.*' tags: - 'apache-iceberg-**' + pull_request: + paths-ignore: + - '.github/ISSUE_TEMPLATE/**' + - '.github/workflows/api-binary-compatibility.yml' + - '.github/workflows/delta-conversion-ci.yml' + - '.github/workflows/docs-ci.yml' + - '.github/workflows/flink-ci.yml' + - '.github/workflows/hive-ci.yml' + - '.github/workflows/java-ci.yml' + - '.github/workflows/jmh-benchmarks-ci.yml' + - '.github/workflows/labeler.yml' + - '.github/workflows/license-check.yml' + - '.github/workflows/open-api.yml' + - '.github/workflows/publish-snapshot.yml' + - '.github/workflows/recurring-jmh-benchmarks.yml' + - '.github/workflows/site-ci.yml' + - '.github/workflows/spark-ci.yml' + - '.github/workflows/kafka-connect-ci.yml' + - '.github/workflows/stale.yml' + - '.gitignore' + - '.asf.yaml' + - 'dev/**' + - 'docker/**' + - 'mr/**' + - 'flink/**' + - 'spark/**' + - 'docs/**' + - 'site/**' + - 'open-api/**' + - 'format/**' + - '.gitattributes' + - '**/README.md' + - 'CONTRIBUTING.md' + - '**/LICENSE' + - '**/NOTICE' + - 'doap.rdf' permissions: contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: # ------------------------------------------------------------------ # Trivy CVE scan — scans bundled jars for known vulnerabilities. # - # Runs on push to main/release branches only (not PRs). Results are - # uploaded as SARIF to the GitHub Security tab for ongoing tracking. - # The scan is informational and does not block the build. + # Behaviour: + # - On PRs: the scan blocks CI if CVEs are found (exit-code 1). + # - On push to main/release branches: the scan is informational + # (exit-code 0) and results are uploaded as SARIF to the GitHub + # Security tab for ongoing tracking. # ------------------------------------------------------------------ kafka-connect-cve-scan: runs-on: ubuntu-24.04 @@ -76,7 +114,8 @@ jobs: scanners: 'vuln' severity: 'HIGH,CRITICAL' limit-severities-for-sarif: true - exit-code: '0' + # Block PRs on CVE findings; on main/release branches report without failing + exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }} format: 'sarif' output: 'trivy-results.sarif' - name: Print Trivy scan results @@ -89,7 +128,7 @@ jobs: echo "No SARIF file found — scan may have failed to install." fi - name: Upload Trivy results to GitHub Security tab - if: always() + if: always() && github.event_name == 'push' uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: sarif_file: 'trivy-results.sarif' From 99162bd645df6fd2b8569d67e0e34a3882b11dcf Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Mon, 11 May 2026 12:06:46 -0700 Subject: [PATCH 4/7] comment --- .github/workflows/kafka-connect-cve-scan.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/kafka-connect-cve-scan.yml b/.github/workflows/kafka-connect-cve-scan.yml index 0b58949458b3..eb1fccca0847 100644 --- a/.github/workflows/kafka-connect-cve-scan.yml +++ b/.github/workflows/kafka-connect-cve-scan.yml @@ -78,6 +78,8 @@ jobs: # # Behaviour: # - On PRs: the scan blocks CI if CVEs are found (exit-code 1). + # SARIF upload is skipped because GitHub's Security tab only + # accepts results from default/protected branches. # - On push to main/release branches: the scan is informational # (exit-code 0) and results are uploaded as SARIF to the GitHub # Security tab for ongoing tracking. From 72a4ea1f36bb6fe2a5ea765ffb2f3d74176df8ea Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Tue, 12 May 2026 09:58:25 -0700 Subject: [PATCH 5/7] fix rebase Co-authored-by: Copilot --- .github/workflows/cve-scan.yml | 20 ++- .github/workflows/kafka-connect-cve-scan.yml | 136 ------------------- 2 files changed, 13 insertions(+), 143 deletions(-) delete mode 100644 .github/workflows/kafka-connect-cve-scan.yml diff --git a/.github/workflows/cve-scan.yml b/.github/workflows/cve-scan.yml index a255104013d2..9ba1a6536665 100644 --- a/.github/workflows/cve-scan.yml +++ b/.github/workflows/cve-scan.yml @@ -27,22 +27,27 @@ on: - '2.*' tags: - 'apache-iceberg-**' + pull_request: permissions: contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: # ------------------------------------------------------------------ # Trivy CVE scan — scans bundled jars for known vulnerabilities. # - # Runs on push to main/release branches only (not PRs). Results are - # uploaded as SARIF to the GitHub Security tab for ongoing tracking. - # The scan is informational and does not block the build. + # Behaviour: + # - On PRs: the scan blocks CI if CVEs are found (exit-code 1). + # SARIF upload is skipped because GitHub's Security tab only + # accepts results from default/protected branches. + # - On push to main/release branches: the scan is informational + # (exit-code 0) and results are uploaded as SARIF to the GitHub + # Security tab for ongoing tracking. # ------------------------------------------------------------------ cve-scan: runs-on: ubuntu-24.04 @@ -126,7 +131,7 @@ jobs: with: distribution: zulu java-version: 21 - - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle + - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 - name: Build ${{ matrix.distribution }} run: | ./gradlew -DsparkVersions= -DflinkVersions= \ @@ -148,7 +153,8 @@ jobs: scanners: 'vuln' severity: 'HIGH,CRITICAL' limit-severities-for-sarif: true - exit-code: '0' + # Block PRs on CVE findings; on main/release branches report without failing + exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }} format: 'sarif' output: 'trivy-results.sarif' - name: Print Trivy scan results @@ -161,7 +167,7 @@ jobs: echo "No SARIF file found — scan may have failed to install." fi - name: Upload Trivy results to GitHub Security tab - if: always() + if: always() && github.event_name == 'push' uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 with: sarif_file: 'trivy-results.sarif' diff --git a/.github/workflows/kafka-connect-cve-scan.yml b/.github/workflows/kafka-connect-cve-scan.yml deleted file mode 100644 index eb1fccca0847..000000000000 --- a/.github/workflows/kafka-connect-cve-scan.yml +++ /dev/null @@ -1,136 +0,0 @@ -# -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. -# - -name: "Kafka Connect CVE Scan" -on: - push: - branches: - - 'main' - - '0.*' - - '1.*' - - '2.*' - tags: - - 'apache-iceberg-**' - pull_request: - paths-ignore: - - '.github/ISSUE_TEMPLATE/**' - - '.github/workflows/api-binary-compatibility.yml' - - '.github/workflows/delta-conversion-ci.yml' - - '.github/workflows/docs-ci.yml' - - '.github/workflows/flink-ci.yml' - - '.github/workflows/hive-ci.yml' - - '.github/workflows/java-ci.yml' - - '.github/workflows/jmh-benchmarks-ci.yml' - - '.github/workflows/labeler.yml' - - '.github/workflows/license-check.yml' - - '.github/workflows/open-api.yml' - - '.github/workflows/publish-snapshot.yml' - - '.github/workflows/recurring-jmh-benchmarks.yml' - - '.github/workflows/site-ci.yml' - - '.github/workflows/spark-ci.yml' - - '.github/workflows/kafka-connect-ci.yml' - - '.github/workflows/stale.yml' - - '.gitignore' - - '.asf.yaml' - - 'dev/**' - - 'docker/**' - - 'mr/**' - - 'flink/**' - - 'spark/**' - - 'docs/**' - - 'site/**' - - 'open-api/**' - - 'format/**' - - '.gitattributes' - - '**/README.md' - - 'CONTRIBUTING.md' - - '**/LICENSE' - - '**/NOTICE' - - 'doap.rdf' - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - -jobs: - - # ------------------------------------------------------------------ - # Trivy CVE scan — scans bundled jars for known vulnerabilities. - # - # Behaviour: - # - On PRs: the scan blocks CI if CVEs are found (exit-code 1). - # SARIF upload is skipped because GitHub's Security tab only - # accepts results from default/protected branches. - # - On push to main/release branches: the scan is informational - # (exit-code 0) and results are uploaded as SARIF to the GitHub - # Security tab for ongoing tracking. - # ------------------------------------------------------------------ - kafka-connect-cve-scan: - runs-on: ubuntu-24.04 - permissions: - contents: read - security-events: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 - with: - distribution: zulu - java-version: 21 - - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle - - name: Build Kafka Connect distribution for scanning - run: | - ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions=3 \ - :iceberg-kafka-connect:iceberg-kafka-connect-runtime:distZip \ - -Pquick=true -x test -x javadoc - - name: Unpack distribution for scanning - run: | - mkdir -p /tmp/kafka-connect-scan - unzip kafka-connect/kafka-connect-runtime/build/distributions/iceberg-kafka-connect-runtime-*.zip \ - -d /tmp/kafka-connect-scan - - name: Run Trivy vulnerability scan - uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2 - with: - scan-type: 'rootfs' - scan-ref: '/tmp/kafka-connect-scan' - scanners: 'vuln' - severity: 'HIGH,CRITICAL' - limit-severities-for-sarif: true - # Block PRs on CVE findings; on main/release branches report without failing - exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }} - format: 'sarif' - output: 'trivy-results.sarif' - - name: Print Trivy scan results - if: always() - run: | - if [ -f trivy-results.sarif ]; then - echo "## Trivy CVE Scan Results" - jq -r '.runs[].results[] | "- \(.ruleId): \(.message.text)"' trivy-results.sarif 2>/dev/null || echo "No findings or unable to parse SARIF." - else - echo "No SARIF file found — scan may have failed to install." - fi - - name: Upload Trivy results to GitHub Security tab - if: always() && github.event_name == 'push' - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 - with: - sarif_file: 'trivy-results.sarif' From 44c8e40a0476a6fd09dad8366a44d6691799a610 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Tue, 12 May 2026 10:32:10 -0700 Subject: [PATCH 6/7] trivy ignore spark 3.4 for now Co-authored-by: Copilot --- .../trivyignores/spark-runtime-3.4_2.12.trivyignore | 10 ++++++++++ .github/workflows/cve-scan.yml | 2 ++ 2 files changed, 12 insertions(+) create mode 100644 .github/trivyignores/spark-runtime-3.4_2.12.trivyignore diff --git a/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore b/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore new file mode 100644 index 000000000000..9f58cf8ac015 --- /dev/null +++ b/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore @@ -0,0 +1,10 @@ +# CVE ignore list for spark-runtime-3.4_2.12. +# +# Each entry: CVE ID, optional expiry (`exp:YYYY-MM-DD`), and rationale. +# Format reference: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/#trivyignore + +# CVE-2025-52999 — jackson-core 2.14.2 StackoverflowError on deeply-nested input. +# Pinned by Spark 3.4 runtime compatibility (Spark 3.4 ships jackson 2.14). +# Spark 3.4 support is being removed from Iceberg in the near term; track the +# removal and drop this file when the spark-runtime-3.4 module goes away. +CVE-2025-52999 diff --git a/.github/workflows/cve-scan.yml b/.github/workflows/cve-scan.yml index 9ba1a6536665..533639aa2bee 100644 --- a/.github/workflows/cve-scan.yml +++ b/.github/workflows/cve-scan.yml @@ -82,6 +82,7 @@ jobs: :iceberg-spark:iceberg-spark-runtime-3.4_2.12:shadowJar scan-path: spark/v3.4/spark-runtime/build/libs unpack: false + trivyignores: .github/trivyignores/spark-runtime-3.4_2.12.trivyignore - distribution: spark-runtime-3.5_2.12 build-task: >- -DsparkVersions=3.5 @@ -153,6 +154,7 @@ jobs: scanners: 'vuln' severity: 'HIGH,CRITICAL' limit-severities-for-sarif: true + trivyignores: ${{ matrix.trivyignores || '' }} # Block PRs on CVE findings; on main/release branches report without failing exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }} format: 'sarif' From 192dcd177c335f7207b77e89e76ee7aa0f479775 Mon Sep 17 00:00:00 2001 From: Kevin Liu Date: Tue, 12 May 2026 10:47:52 -0700 Subject: [PATCH 7/7] asf header Co-authored-by: Copilot --- .../spark-runtime-3.4_2.12.trivyignore | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore b/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore index 9f58cf8ac015..c6ba9b180693 100644 --- a/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore +++ b/.github/trivyignores/spark-runtime-3.4_2.12.trivyignore @@ -1,3 +1,22 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + # CVE ignore list for spark-runtime-3.4_2.12. # # Each entry: CVE ID, optional expiry (`exp:YYYY-MM-DD`), and rationale.