Move image scans from gate to inform - #488
Merged
Merged
Conversation
Newly published advisories turn the release branch red overnight and block every open PR, including changes that cannot have introduced the finding. CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 did this on 2026-08-19: the base branch and #458 both failed on a CVE unrelated to their content. inform still runs Trivy and Grype, still applies VEX and the exceptions directory, and still prints the findings tables and evaluation summary; only the exit code changes, since ExitCode returns 0 unconditionally in inform mode. The trade-off is deliberate: an image with unmanaged HIGH or CRITICAL findings, or with expired exceptions, will now build and publish rather than fail. Remediation pressure moves to the CVE ticket workstream and the scheduled chart scans. The step names carry report-only so a green scan step is not mistaken for a passed gate. Fixes #487 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LouisParkin
enabled auto-merge
August 19, 2026 11:57
Author
|
All three checks green; auto-merge armed. Worth knowing for the review: today's scanner DB refresh produced two new HIGH findings, not one. This PR's own Binary and DEB builds passed against a base carrying both, which is the mechanism working as intended. |
LouisLotter
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches the cluster-agent and agent image scans from
mode: gatetomode: inform, per LouisLotter — the intention is not to keep getting stuck on CVEs that a PR did not introduce.CVE-2026-73500is the current example: it turnedstackstate-7.78.2red overnight and blocked #458, which only touches a beest workflow.Kept: Trivy and Grype still run, VEX and
exceptions/still apply, and the findings tables and evaluation summary are still printed. Only the exit code changes.Given up: an image with unmanaged HIGH/CRITICAL findings, or expired exceptions, now builds and publishes instead of failing. Remediation pressure moves to the CVE ticket workstream and the scheduled chart scans.
Step names gained
report-onlyso a green scan step is not read as a passed gate.Fixes #487