From ba50e8decf0bf9f2a3bc41d3e9193bf91f598a03 Mon Sep 17 00:00:00 2001 From: Maaz Husain Date: Tue, 23 Jun 2026 16:55:09 +0100 Subject: [PATCH 1/2] Phase 4: add Trivy CI security gate --- .github/workflows/security.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..088f993 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,19 @@ +name: Container Security Scan +on: [push, pull_request] + +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Build hardened image + run: docker build -f dockerfiles/Dockerfile.v4-distroless -t myapp:ci . + + - name: Scan with Trivy (fail on CRITICAL/HIGH) + uses: aquasecurity/trivy-action@master + with: + image-ref: myapp:ci + severity: CRITICAL,HIGH + exit-code: '1' + ignore-unfixed: true From 84f866f284e257ae54a8e255762fa828b5d55e5d Mon Sep 17 00:00:00 2001 From: Maaz Husain Date: Tue, 23 Jun 2026 17:02:41 +0100 Subject: [PATCH 2/2] Phase 4: document base-image CVE exceptions in .trivyignore --- .trivyignore | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 0000000..de9e7eb --- /dev/null +++ b/.trivyignore @@ -0,0 +1,6 @@ +# Base-image CVEs in gcr.io/distroless/python3-debian12. +# Fixed in Debian upstream but not yet shipped in the distroless base build. +# Action: re-pin the base digest and delete these lines once distroless rebuilds. +# Reviewed 2026-06-23. +CVE-2025-13836 +CVE-2026-45447