[demo] oci-security-scan: trivy image scanning via makefile-modules

[wallrj]

What

Demonstrates the new combined security-scan capability from cert-manager/makefile-modules#688 in a real consumer repo.

DO NOT MERGE — klone.yaml temporarily points the go and oci-build modules at the makefile-modules fork branch (wallrj/makefile-modules@oci-security-scan). Once cert-manager/makefile-modules#688 merges, repoint at upstream main (or let the regular module upgrade pick it up).

What you get

• make oci-scan-manager / make oci-security-scan — builds the image(s) and scans with trivy for fixable vulnerabilities of severity MEDIUM, HIGH or CRITICAL (--scanners vuln --ignore-unfixed); human readable table output; non-zero exit if any are found. One oci-scan-<name> target per build_names entry, so multi-image repos are covered.
• The existing nightly govulncheck workflow becomes a single combined security-scan workflow (same govulncheck.yaml file, so GitHub keeps it registered and dispatchable): runs verify-govulncheck plus oci-security-scan (guarded by target existence) against the default branch, the two newest release-X.Y branches and the latest non-pre-release tag.

Demonstration — dispatched pre-merge on this branch

Because the workflow file already exists on master, it could be triggered on this branch before merging:
https://github.com/cert-manager/csi-driver/actions/runs/31016050175

Results (working exactly as designed):

• security-scan (oci-security-scan) ✅ — govulncheck clean; image built with the repo-pinned Go 1.26.5 and trivy found 0 vulnerabilities (alpine 3.23 base: 0, Go binary: 0).
• security-scan (v0.15.0) ❌ — the latest released tag fails verify-govulncheck with 5 known vulnerabilities (google.golang.org/grpc → v1.82.1, golang.org/x/text → v0.39.0, go-pkcs12 → v0.7.2, and Go stdlib crypto/tls / net/textproto → go1.26.5) — i.e. the nightly early warning that a new release is needed, which v0.16.0 will address.

Note: an earlier version of this PR claimed 23 fixable CVEs on main — that was an artifact of building locally with an older system Go (1.26.0). When built with the repo-pinned Go toolchain (as CI does, and as make vendor-go does locally) the image is clean.

🤖 Generated with Claude Code

[cert-manager-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign thatsmrtalbot for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wallrj]

Note on triggering the scheduled workflow: GitHub only registers a workflow (for schedule and workflow_dispatch) once the file exists on the default branch, so it cannot be triggered from this PR branch — gh workflow run oci-security-scan.yaml --ref oci-security-scan returns 404 until this merges. After merge it can be triggered immediately with:

gh workflow run oci-security-scan.yaml --repo cert-manager/csi-driver

and the nightly schedule (02:00 UTC) takes over from there.

To reproduce the scan locally on this branch:

make oci-security-scan

Current result on main/this branch: fails with 23 fixable CVEs (9 MEDIUM, 14 HIGH) — Go 1.26.0 stdlib, all fixed by a toolchain bump to ≥1.26.1.

🤖 Generated with Claude Code

[wallrj]

Update: the workflow HAS now been tested pre-merge. By folding oci-security-scan into the existing govulncheck.yaml (which is already registered on master), workflow_dispatch works on this branch:

gh workflow run govulncheck.yaml --repo cert-manager/csi-driver --ref oci-security-scan

Run: https://github.com/cert-manager/csi-driver/actions/runs/31016050175

• security-scan (oci-security-scan) ✅ — image built with repo-pinned Go 1.26.5: trivy reports 0 vulnerabilities.
• security-scan (v0.15.0) ❌ — latest released tag fails govulncheck with 5 known vulns (grpc, x/text, go-pkcs12, Go stdlib crypto/tls & net/textproto) — the intended early warning for released artifacts.

Correction to my earlier comment: the "23 fixable CVEs on main" figure came from a local build using system Go 1.26.0; built with the repo-pinned toolchain the image is clean, so no toolchain bump is needed on main.

🤖 Generated with Claude Code

[wallrj]

Second pre-merge dispatch, now with third party sidecar scanning (oci_scan_extra_images): https://github.com/cert-manager/csi-driver/actions/runs/31017653739

• security-scan (oci-security-scan) ❌ — the cert-manager-csi-driver image itself is clean, but registry.k8s.io/sig-storage/livenessprobe:v2.18.0 (as deployed by this chart) has 32 fixable vulnerabilities (12 MEDIUM, 19 HIGH, 1 CRITICAL — grpc CVE-2026-33186, fixed in grpc v1.79.3). A sidecar version bump is needed; the scan stops at the first failing image, so node-driver-registrar will be reported once livenessprobe is bumped.
• security-scan (v0.15.0) ❌ — unchanged: the latest released tag fails govulncheck with 5 known vulns.

Both failures are the workflow doing its job.

🤖 Generated with Claude Code

[wallrj]

Rebased onto main (9584ddd), which includes the Renovate sidecar bumps to livenessprobe v2.19.0 and csi-node-driver-registrar v2.17.0. Because oci_scan_extra_images is composed from the pinned *_image_name_source/*_image_tag variables, the scan picked up the new tags with no changes to this PR.

Re-dispatched run: https://github.com/cert-manager/csi-driver/actions/runs/31036062367

• security-scan (v0.16.0) ✅ — the new release passes both govulncheck and the image scan (the matrix automatically switched from v0.15.0 to the new latest tag).
• security-scan (oci-security-scan branch) ❌ — the csi-driver image itself is clean, but livenessprobe:v2.19.0 still has 13 fixable vulnerabilities (5 MEDIUM, 8 HIGH, 0 CRITICAL) — down from 32 incl. 1 CRITICAL in v2.18.0. csi-node-driver-registrar:v2.17.0 has the same 13 (scanned locally; the loop stops at the first failing image). These are mostly Go stdlib CVEs (e.g. CVE-2026-39822, fixed in Go 1.26.5), so they need an upstream sig-storage rebuild/release rather than a tag bump here.

with claude fable 5