The before_script of the CVE scan template clones its helper scripts into a fixed path:
echo "Cloning cve-scripts repository"
rm -rf /tmp/cve-scripts
git clone --depth 1 --branch v2.0 "$CVE_TEST_REPO_GIT" /tmp/cve-scripts
cp /tmp/cve-scripts/*.sh /tmp/cve-scripts/*.py .
The deckhouse-gitlab-runner-* runners are shared across the group, so two scan jobs from different projects can land on the same runner at the same time. When they do, one job's rm -rf and git clone race against the other's, and the loser dies before running a single line of the scan:
fatal: Untracked working tree file '.gitignore' would be overwritten by merge.
We hit this on the default branch of deckhouse/virtualization/ansible-module (the scan job of pipeline 731119); a retry landed on another runner and passed.
A consumer of the template cannot work around it:
- overriding
before_script in the job replaces the template's own, which is where the Vault token is obtained and the vault: values are resolved;
retry: when: script_failure does not help either, because "vulnerabilities found" exits with the same status — every scan with findings would burn Trivy three times.
Suggested fix — a unique directory per job, removed on the way out:
cve_scripts_dir="$(mktemp -d)"
trap 'rm -rf "${cve_scripts_dir}"' EXIT
git clone --depth 1 --branch v2.0 "$CVE_TEST_REPO_GIT" "${cve_scripts_dir}"
cp "${cve_scripts_dir}"/*.sh "${cve_scripts_dir}"/*.py .Happy to send this as a pull request if that is easier.
The
before_scriptof the CVE scan template clones its helper scripts into a fixed path:The
deckhouse-gitlab-runner-*runners are shared across the group, so two scan jobs from different projects can land on the same runner at the same time. When they do, one job'srm -rfandgit clonerace against the other's, and the loser dies before running a single line of the scan:We hit this on the default branch of
deckhouse/virtualization/ansible-module(the scan job of pipeline 731119); a retry landed on another runner and passed.A consumer of the template cannot work around it:
before_scriptin the job replaces the template's own, which is where the Vault token is obtained and thevault:values are resolved;retry: when: script_failuredoes not help either, because "vulnerabilities found" exits with the same status — every scan with findings would burn Trivy three times.Suggested fix — a unique directory per job, removed on the way out:
Happy to send this as a pull request if that is easier.