Newly published advisories turn the whole of stackstate-7.78.2 red overnight and block every open PR, including changes that cannot have introduced the finding. CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 did exactly this on 2026-08-19: the base branch and #458 both failed on a CVE unrelated to their content, and #458 now needs a rebase purely to pick up the fix.
Per LouisLotter, the intention is not to keep getting stuck on CVEs like this, so the image scans move from gate to inform.
Change: mode: gate → mode: inform on the scan-image calls in:
.github/workflows/build-binaries.yml (cluster-agent image).github/workflows/build-deb.yml
What is preserved: inform still runs Trivy and Grype, still applies VEX and the exceptions/ directory, and still prints the full findings tables and evaluation summary. Only the exit code changes — ExitCode returns 0 unconditionally in inform mode.
What is given up: an image with unmanaged HIGH/CRITICAL findings, or with expired exceptions, will now build and publish rather than failing the job. Remediation pressure moves entirely to the CVE ticket workstream (project 4) and the scheduled chart scans.
Newly published advisories turn the whole of
stackstate-7.78.2red overnight and block every open PR, including changes that cannot have introduced the finding.CVE-2026-73500ingo.etcd.io/etcd/client/pkg/v3did exactly this on 2026-08-19: the base branch and #458 both failed on a CVE unrelated to their content, and #458 now needs a rebase purely to pick up the fix.Per LouisLotter, the intention is not to keep getting stuck on CVEs like this, so the image scans move from
gatetoinform.Change:
mode: gate→mode: informon thescan-imagecalls in:.github/workflows/build-binaries.yml(cluster-agent image).github/workflows/build-deb.ymlWhat is preserved:
informstill runs Trivy and Grype, still applies VEX and theexceptions/directory, and still prints the full findings tables and evaluation summary. Only the exit code changes —ExitCodereturns 0 unconditionally in inform mode.What is given up: an image with unmanaged HIGH/CRITICAL findings, or with expired exceptions, will now build and publish rather than failing the job. Remediation pressure moves entirely to the CVE ticket workstream (project 4) and the scheduled chart scans.