From 9ee42abe0790ffc734d66d62a37eb17e3fa964de Mon Sep 17 00:00:00 2001 From: Louis Parkin Date: Wed, 19 Aug 2026 11:41:04 +0200 Subject: [PATCH] Move image scans from gate to inform Newly published advisories turn the release branch red overnight and block every open PR, including changes that cannot have introduced the finding. CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 did this on 2026-08-19: the base branch and #458 both failed on a CVE unrelated to their content. inform still runs Trivy and Grype, still applies VEX and the exceptions directory, and still prints the findings tables and evaluation summary; only the exit code changes, since ExitCode returns 0 unconditionally in inform mode. The trade-off is deliberate: an image with unmanaged HIGH or CRITICAL findings, or with expired exceptions, will now build and publish rather than fail. Remediation pressure moves to the CVE ticket workstream and the scheduled chart scans. The step names carry report-only so a green scan step is not mistaken for a passed gate. Fixes #487 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/build-binaries.yml | 4 ++-- .github/workflows/build-deb.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-binaries.yml b/.github/workflows/build-binaries.yml index 42a34b3e36ac..66731471f00a 100644 --- a/.github/workflows/build-binaries.yml +++ b/.github/workflows/build-binaries.yml @@ -239,11 +239,11 @@ jobs: --entrypoint /opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent \ "${LOCAL_IMAGE}" version - - name: Scan cluster-agent image (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets) + - name: Scan cluster-agent image, report-only (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets) uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63 with: image: ${{ env.LOCAL_IMAGE }} - mode: gate + mode: inform severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL with-grype: true exceptions-path: exceptions diff --git a/.github/workflows/build-deb.yml b/.github/workflows/build-deb.yml index 94bce90a4b53..65ffcdf77fa7 100644 --- a/.github/workflows/build-deb.yml +++ b/.github/workflows/build-deb.yml @@ -278,11 +278,11 @@ jobs: set -eo pipefail docker run --rm --entrypoint /opt/stackstate-agent/bin/agent/agent "${LOCAL_IMAGE}" version - - name: Scan agent image (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets) + - name: Scan agent image, report-only (Trivy and Grype vulnerabilities, VEX-aware, plus Trivy secrets) uses: StackVista/image-pipeline/.github/actions/scan-image@6284a6fc006a7cc46a7f00d02c50d5f21b117b63 with: image: ${{ env.LOCAL_IMAGE }} - mode: gate + mode: inform severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL with-grype: true exceptions-path: exceptions