oci-build: add oci-security-scan target and scheduled workflow - #688
Open
wallrj wants to merge 6 commits into
Open
oci-build: add oci-security-scan target and scheduled workflow#688wallrj wants to merge 6 commits into
wallrj wants to merge 6 commits into
Conversation
cert-manager-prow
Bot
added
do-not-merge/work-in-progress
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
cert-manager-prow
Bot
added
the
size/L
Add an oci-scan-<build_name> target for each OCI image and an oci-security-scan aggregate target, which scan the images using trivy for OS and library vulnerabilities which have a known fix and a severity of MEDIUM, HIGH or CRITICAL. The scan fails (exit code 1) if any such vulnerabilities are found, and prints a human readable report. Also generate a scheduled GitHub Actions workflow in downstream repositories, which runs oci-security-scan every night against the default branch, the two newest release branches and the latest release tag, to give early warning when released images, or images about to be released, contain fixable vulnerabilities. Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
cert-manager-prow
Bot
added
size/M
Instead of generating a second scheduled workflow file, extend the existing govulncheck workflow (shipped by the go module) into a single nightly security-scan workflow which runs verify-govulncheck and, where the repository builds OCI images, oci-security-scan. It scans the default branch, the two newest release branches and the latest release tag. The file keeps its historic govulncheck.yaml name so that GitHub continues to treat it as the same registered workflow, which means it can be triggered with workflow_dispatch on any branch (including pre-merge testing of this change), and no stale workflow files are left in downstream repositories. Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Skip the secret scanner, which is slow and not the purpose of this target. Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Some repositories (csi-driver, csi-driver-spiffe) deploy third party sidecar images alongside the images they build. List them in the new oci_scan_extra_images variable to have oci-security-scan scan them too. The trivy policy flags are factored into a trivy_scan_flags variable shared by all the scan targets. Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
wallrj
added a commit
to cert-manager/csi-driver
that referenced
this pull request
Aug 5, 2026
Demonstrates cert-manager/makefile-modules#688: klone.yaml temporarily points the oci-build module at the fork branch, which adds: - make oci-scan-manager / make oci-security-scan: build the OCI image and scan it with trivy for fixable MEDIUM, HIGH and CRITICAL vulnerabilities, failing if any are found. - A generated nightly GitHub Actions workflow which runs the scan against the default branch, the two newest release branches and the latest release tag. DO NOT MERGE until cert-manager/makefile-modules#688 is merged and klone.yaml is repointed at the upstream module. Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Trivy's table format is hard to read in the raw GitHub Actions job log because of line wrapping and timestamps. Append each scan report to $GITHUB_STEP_SUMMARY (inside a fenced code block, one heading per image) where it renders as fixed-width text on the run page. Only do this when GITHUB_STEP_SUMMARY is set, because some repos using this module run their CI on GitLab; there and locally the behaviour is unchanged (report on stdout, non-zero exit on findings). Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Previously oci-scan-extra-images exited at the first vulnerable image, so only the first report appeared in the log and job summary. Scan every image, then exit non-zero if any scan failed. Likewise run the workflow step with make --keep-going so a vulnerable built image does not prevent the remaining oci-scan-* prerequisites from running. Signed-off-by: Richard Wall <richard@the-moon.net> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
wallrj
marked this pull request as ready for review
August 5, 2026 21:45
cert-manager-prow
Bot
removed
the
do-not-merge/work-in-progress
There was a problem hiding this comment.
Pull request overview
This PR adds an OCI image vulnerability scanning capability to the oci-build makefile module (via Trivy) and integrates it into the Go base nightly workflow so downstream repositories can automatically scan code (govulncheck) and built images (trivy) across relevant refs.
Changes:
- Add
oci-scan-*,oci-scan-extra-images, andoci-security-scantargets to run Trivy vulnerability scanning (including optional GitHub Actions job summary output). - Introduce configurable
oci_scan_extra_imagesandtrivy_scan_flagsdefaults for scanning sidecar/third-party images and applying a default vulnerability policy. - Update the existing
govulncheck.yamlworkflow to a combinedsecurity-scanworkflow that scans the default branch, newest release branches, and latest non-pre-release tag, and conditionally runsoci-security-scan.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
modules/oci-build/01_mod.mk |
Adds Trivy scan helper + new scan targets (per-image, extra images, aggregate). |
modules/oci-build/00_mod.mk |
Adds configuration variables for extra images and Trivy policy flags; wires scan targets into target lists. |
modules/go/base/.github/workflows/govulncheck.yaml |
Converts the nightly workflow into a combined security scan with ref discovery + conditional OCI scanning. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+93
to
+103
| define trivy_scan | ||
| report=$$(mktemp); \ | ||
| $(TRIVY) image $2 $(trivy_scan_flags) --output $$report; \ | ||
| code=$$?; \ | ||
| cat $$report; \ | ||
| if [ -n "$${GITHUB_STEP_SUMMARY:-}" ]; then \ | ||
| { echo "### $1"; echo '```'; cat $$report; echo '```'; echo; } >> "$$GITHUB_STEP_SUMMARY"; \ | ||
| fi; \ | ||
| rm -f $$report; \ | ||
| exit $$code | ||
| endef |
Comment on lines
+134
to
+139
| .PHONY: oci-security-scan | ||
| ## Scan all the OCI images built by this repository, and any extra images | ||
| ## listed in oci_scan_extra_images, for known vulnerabilities; failing if any | ||
| ## fixable vulnerabilities of severity MEDIUM, HIGH or CRITICAL are found. | ||
| ## @category [shared] Build | ||
| oci-security-scan: $(oci_scan_targets) oci-scan-extra-images |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds OCI image vulnerability scanning to makefile-modules, so every project gets it for free.
Example
build_names := manager approver) which also scans its two third-party sidecar images. The job summary page shows a readable trivy report per image:cert-manager.local/cert-manager-csi-driver-spiffe✅ cleancert-manager.local/cert-manager-csi-driver-spiffe-approver✅ cleanregistry.k8s.io/sig-storage/livenessprobe:v2.19.0❌ 13 fixable (5 MEDIUM, 8 HIGH)registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0❌ 13 fixable (5 MEDIUM, 8 HIGH)...and the
security-scan (v0.15.0)matrix job shows the latest released tag being checked (govulncheck clean; the tag predates this module so the image scan skips itself with a notice).How
oci-build module — new make targets:
oci-scan-<build_name>— builds the image for the local architecture and scans it with trivy (the same tool used by the Artifact Hub security report). Reports only vulnerabilities which are fixable (--ignore-unfixed) and of severity MEDIUM, HIGH or CRITICAL, vulnerability scanner only (--scanners vuln— the secret scanner is slow), human readable table output, non-zero exit if any are found. Policy flags are overridable viatrivy_scan_flags.oci-scan-extra-images— scans the image refs listed in the newoci_scan_extra_imagesvariable, for third-party sidecar images deployed alongside the repo's own images (e.g. csi-driver's livenessprobe and node-driver-registrar).oci-security-scan— aggregate target which scans all images inbuild_namesplus the extra images (handles multi-image projects). Run this on a release branch just before tagging. All images are scanned even if an earlier one fails, so every report is produced before the target exits non-zero.GITHUB_STEP_SUMMARYbeing set — some consumer repos run CI on GitLab, where behaviour is unchanged) each report is also appended to the job summary, because the trivy table is hard to read in the raw job log.go module — the existing nightly govulncheck workflow becomes a single combined
security-scanworkflow:verify-govulncheckand (where the repo builds OCI images — guarded by target existence)make --keep-going oci-security-scan.release-X.Ybranches and the latest non-pre-release tag, giving early warning when released images contain fixable vulnerabilities.govulncheck.yamlname so GitHub treats it as the same registered workflow:workflow_dispatchkeeps working on any branch (which allowed pre-merge CI testing of this change), and no stale workflow files are left in downstream repos.Why
We want early warning when our released OCI images contain known fixable vulnerabilities, and a pre-release check so we don't tag releases containing them. cert-manager has bespoke
trivy-scan-*targets; this makes the capability available to all repos via makefile-modules, and keeps a single nightly security workflow per repo.Testing
govulncheck.yamlis already registered):v0.16.0release ✅ clean.make oci-scan-managerbuilds the image and scans it (exit 1 + human readable table when fixable CVEs are present);make generate/make verify-generatepass and produce the single combined workflow file.release-X.Ymatching, version-sorted; latest non-pre-release tag).🤖 Generated with Claude Code