feat: restore Trivy scanning via Socket-built distribution - #100
Draft
lelia wants to merge 3 commits into
Draft
Conversation
Trivy returns to the main, heavy, and app_tests images as a Socket-built distribution: rebuilt from unmodified upstream source (v0.73.0) by Socket's own release pipeline and pinned by digest (TRIVY_IMAGE build arg; override available for builds without registry access). - Dockerfiles: digest-pinned trivy stage restored; version label now truthful - CI: GHCR login on every build mode (private base image) + packages: read - Smoke tests: drop the removal guard; verify trivy presence, version-pin agreement, and a functional 'trivy config' scan (the connector's code path) - Dependabot: trivy untracked by design — updates flow from the Socket release process, never independent bumps - Docs: removed the temporarily-disabled messaging repo-wide; kept the 0.69.4-0.69.6 warnings for native installs; fixed the APT example to the 'generic' distribution (upstream change in trivy v0.72.0) Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Batch with the Trivy restore since this warrants a major point release: TruffleHog 3.93.8 -> 3.96.0, OpenGrep v1.16.5 -> v1.26.0, uv 0.10.11 -> 0.12.1, gosec v2.24.7 -> v2.28.0 (app_tests), Go 1.24.1 -> 1.26.5 (app_tests), Socket CLI 2.5.0 -> 2.5.8 (heavy). Runtime bases (python:3.12, node:22) deliberately deferred to their own PR. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Contributor
Author
|
Added the OSS toolchain refresh to this PR (major point release anyway): TruffleHog → 3.96.0, OpenGrep → v1.26.0, uv → 0.12.1, gosec → v2.28.0, Go → 1.26.5 (app_tests), Socket CLI → 2.5.8 (heavy). Runtime bases ( |
The app_tests image predates the socket_basics layout migration: its COPY src/... and entrypoint.sh references no longer exist anywhere in the repo, so it could not build at all (its CI job only fires on app_tests changes and had not run since). Drop the stale references (tools image for now; modernizing the harness is follow-up work) and build with app_tests/ as the context so its own pyproject/uv.lock and fixtures resolve. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Restores Trivy-backed container/Dockerfile/vulnerability scanning to the pre-built images. Trivy now comes from Socket's own build — rebuilt from unmodified upstream source (currently v0.73.0) and pinned by digest via a
TRIVY_IMAGEbuild arg — instead of upstream-published binaries/images.Changes
ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f1…;COPY --from=trivyre-enabled; thecom.socket.trivy-versionlabel now matches an actually-present binary.aquasec/trivy:0.69.3from Docker Hub by mutable tag — converted to the same digest-pinned Socket image._docker-pipelinemode (the base image is private), withpackages: readgranted in callers.MUST_NOT_EXIST_TOOLSguard; addedtrivy --versionto all check sets, plus two new assertions — the binary version must agree with the Dockerfile pin, andtrivy config --format json(the connector's exact invocation) must succeed on a fixture.aquasec/trivyremoved from docker allow-lists — trivy updates flow through the Socket release process only.0.69.4–0.69.6retained; APT instructions fixed to thegenericdistribution (upstream packaging change in v0.72.0).No Python changes: the connector is config-driven and needed none.
Notes for reviewers
ghcr.io/socketdev/trivy; without it:docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .