From 7329580565a0640517023444f9b23f36d5768645 Mon Sep 17 00:00:00 2001
From: Advait Patel <advait.patel@broadcom.com>
Date: Sun, 20 Sep 2026 13:41:51 -0500
Subject: [PATCH] chore: refresh the hardened example's pins, scan workflows
 with CodeQL

Both follow-ups from the #187 review.

The hardened compose example had been pinned to nginx:1.25.3-alpine and
postgres:15.5-alpine since June, carrying 35 CRITICAL/HIGH CVEs. Nothing
surfaced that because the example's images were silently failing to scan,
so the assertion over them was running against an empty result.

nginx:1.31.6-alpine is clean. The 22 findings that remain are all in the
Go stdlib compiled into the official postgres image and have no fix at
any tag - 18.6-alpine reports exactly the same 22 - so the 15 line stays,
which keeps the example about configuration rather than turning it into a
major version upgrade. Verified by scanning all three candidates.

CodeQL gains `language: actions`, so the workflow files are analyzed. It
was already expecting a /language:actions configuration and warned on
every pull request that it could not find one. Autobuild is skipped for
that language, which analyses YAML in place and has nothing to build.
---
 .github/workflows/codeql-analysis.yml      |  9 ++++++++-
 CHANGELOG.md                               | 13 +++++++++++++
 examples/compose/docker-compose-secure.yml |  4 ++--
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0e11650..6758fba 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -22,7 +22,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'python' ]
+        # 'actions' scans the workflow files themselves. CodeQL was already
+        # expecting a /language:actions configuration and warned on every pull
+        # request that it could not find one, so workflow changes were going
+        # unscanned - including the two workflows edited in #187.
+        language: [ 'python', 'actions' ]
 
     steps:
     - name: Checkout repository
@@ -35,7 +39,10 @@ jobs:
         # Run additional queries for comprehensive security analysis
         queries: +security-extended,security-and-quality
 
+    # Autobuild resolves source dependencies; the 'actions' language analyses
+    # YAML in place and has nothing to build.
     - name: Autobuild
+      if: matrix.language != 'actions'
       uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
     - name: Perform CodeQL Analysis
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce817b8..8fece76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -50,6 +50,19 @@ All notable changes to DockSec are documented in this file.
 
 ### Fixed
 
+- Refreshed the hardened compose example's base images (`nginx:1.25.3-alpine` ->
+  `1.31.6-alpine`, `postgres:15.5-alpine` -> `15.19-alpine`). The old pins dated
+  from June and carried 35 CRITICAL/HIGH CVEs, which nothing surfaced while the
+  example's images were silently failing to scan. nginx is now clean; the
+  remaining 22 findings are all in the Go `stdlib` compiled into the official
+  postgres image, which has no fix available upstream at any tag - `18.6-alpine`
+  reports exactly the same 22, so staying on the 15 line costs nothing and keeps
+  the example about configuration rather than a major version upgrade.
+
+- CodeQL now scans the workflow files themselves (`language: actions`). It was
+  already expecting that configuration and warned on every pull request that it
+  could not find one, so workflow changes were going unanalyzed.
+
 - **The container image ignored every command-line argument.** `entrypoint.sh`
   built its argument list only from the Action's `INPUT_*` variables and never
   forwarded `"$@"`, so `docker run ghcr.io/owasp/docksec:latest --version` and
diff --git a/examples/compose/docker-compose-secure.yml b/examples/compose/docker-compose-secure.yml
index df178dd..e604054 100644
--- a/examples/compose/docker-compose-secure.yml
+++ b/examples/compose/docker-compose-secure.yml
@@ -1,7 +1,7 @@
 version: '3.8'
 services:
   web:
-    image: nginx:1.25.3-alpine
+    image: nginx:1.31.6-alpine
     ports:
       - "127.0.0.1:8080:80"
     read_only: true
@@ -22,7 +22,7 @@ services:
       - frontend
 
   db:
-    image: postgres:15.5-alpine
+    image: postgres:15.19-alpine
     user: "70:70"
     read_only: true
     environment: