Repository navigation
ci(scout): scan the image once it is published, and gate on that scan - #74
Merged
Merged
Conversation
Docker Scout reads the published latest image from Docker Hub but ran only on a push to main, weekly or by hand. After the certifi release the Security Posture gate stayed red on the replaced image until Docker Scout and the gate were dispatched by hand. docker-scout.yml now follows the workflow that pushes the image (workflow_run, successful runs only) and security-posture.yml follows "Docker Scout CVE Scan"; the NIS2 document says the scan runs on every image build. Same change as maksimtech/mailradar#67. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Merging this PR will not alter performance1 warning
Comparing 
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docker Scout scans the published
latestimage but ran only on a push to main, weekly or by hand: after the certifi release the Security Posture gate stayed red on the replaced image until both were dispatched by hand.docker-scout.yml: also onworkflow_runof the workflow that pushes the image, completed; the job runs only when that run succeeded.security-posture.yml: also onworkflow_runofDocker Scout CVE Scan; withworkflow_run,github.refisrefs/heads/main.docs/nis2-compliance.md: the Docker Scout row says it runs on every image build.TDD:
tests/test_scan_after_publish.py(the triggers, that the named workflows exist, no scan after a failed push, dispatch and schedule kept, the document) failed before the change. Full suite: 2263 passed, 4 skipped in 117.89s (0:01:57). Same change as maksimtech/mailradar#67.🤖 Generated with Claude Code