[DO NOT MERGE] Demo: oci-security-scan for multi-image repos

[wallrj]

Demonstrates cert-manager/makefile-modules#688 in a multi-image repo (build_names := manager approver).

klone.yaml points the go and oci-build modules at the oci-security-scan branch of wallrj/makefile-modules. This brings:

• oci-scan-manager and oci-scan-approver targets — one per entry in build_names, generated automatically; the aggregate oci-security-scan target scans both built images.
• oci_scan_extra_images, set in make/00_mod.mk from the existing pinned sidecar variables, so livenessprobe:v2.19.0 and csi-node-driver-registrar:v2.17.0 are scanned too and Renovate bumps flow through automatically.
• The govulncheck workflow becomes a combined nightly security-scan (govulncheck + trivy image scan) over the default branch, the two newest release-X.Y branches, and the latest released tag. Keeping the govulncheck.yaml filename means the already-registered workflow can be dispatched pre-merge with --ref.

Trivy policy: --scanners vuln --severity MEDIUM,HIGH,CRITICAL --ignore-unfixed --exit-code 1, human-readable table output.

See cert-manager/csi-driver#716 for the single-image demo.

DO NOT MERGE until makefile-modules#688 is merged and klone.yaml is repointed at upstream main.

🤖 Generated with Claude Code

[cert-manager-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign joshvanl for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wallrj]

Dispatched run demonstrating the multi-image scan: https://github.com/cert-manager/csi-driver-spiffe/actions/runs/31047264571

• security-scan (v0.15.0) ✅ — the fresh release passes govulncheck; the tag predates the module so the image-scan step correctly skips itself with a notice.
• security-scan (oci-security-scan branch) ❌, and for exactly the right reason:
  • oci-scan-manager → clean (the trivy log shows oci-layout-manager.docker.tar (alpine 3.23) scanned)
  • oci-scan-approver → clean (oci-layout-approver.docker.tar scanned) — the approver image is picked up automatically because the targets are generated from build_names := manager approver
  • oci-scan-extra-images → fails on livenessprobe:v2.19.0 with 13 fixable vulnerabilities (5 MEDIUM, 8 HIGH) — the same Go-stdlib CVEs found in [demo] oci-security-scan: trivy image scanning via makefile-modules csi-driver#716, awaiting an upstream sig-storage rebuild (csi-node-driver-registrar:v2.17.0 has the same 13).

with claude fable 5

[cert-manager-prow]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[wallrj]

Updated to makefile-modules commit 049ae80: trivy reports are now also written to the GitHub Actions job summary (one ### <image> section per scanned image, table in a fenced code block), because the table format is hard to read in the raw job log. This is guarded on GITHUB_STEP_SUMMARY being set, so repos running this module's CI on GitLab (and local runs) are unchanged.

See the summary page of https://github.com/cert-manager/csi-driver-spiffe/actions/runs/31048471147 — sections for the manager image (clean), approver image (clean) and livenessprobe:v2.19.0 (13 fixable vulns, still the expected failure).

Note: trivy's --format github was considered and rejected — it emits a dependency-snapshot JSON for GitHub's Dependency submission API (package inventory, no findings), not readable output.

with claude fable 5

[wallrj]

Fixed in makefile-modules commit 9f38f78: the extra-images loop no longer stops at the first vulnerable image, and the workflow runs make --keep-going oci-security-scan so a vulnerable built image can't hide later reports either. The job still exits non-zero if any scan failed.

https://github.com/cert-manager/csi-driver-spiffe/actions/runs/31049028008 now shows all four reports in the job summary: manager (clean), approver (clean), livenessprobe:v2.19.0 (13 fixable: 5 MEDIUM, 8 HIGH) and csi-node-driver-registrar:v2.17.0 (13 fixable: 5 MEDIUM, 8 HIGH).

with claude fable 5