[patrick-dev-pr-bot]

2 commit(s) ahead of main

slim builder image: drop readelf/objdump/perl/pip, bump zlib r1, add VEX for remaining findings

(0066f17)

release: scan image with pinned grype and check VEX coverage per arch

(9bea4b2)

Summary by CodeRabbit

• Security
  • Added vulnerability coverage checks for release images, including validation of scan results, software inventories, and security assessments.
  • Updated security assessments for Alpine packages and Python components, including affected and not-affected findings.
  • Pinned the vulnerability scanner and its checksums, and added database updates and scan reports to the release process.
• Container Images
  • Removed Perl and selected inspection tools from the Alpine image, and removed pip after installation.
  • Updated Alpine zlib packages.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 65f55562-2c85-4a02-8409-af46640c6374

---

📥 Commits

Reviewing files that changed from the base of the PR and between 389d566 and 9bea4b2.

---

📒 Files selected for processing (6)

• .github/scripts/check-vex-coverage.py
• .github/workflows/release.yml
• environments/alpine-3.24-musl/Containerfile
• environments/alpine-3.24-musl/apk.lock.aarch64
• environments/alpine-3.24-musl/apk.lock.x86_64
• environments/alpine-3.24-musl/vex/builder.openvex.json

---

 ______________________________________________________________
< Security by obscurity? I'm about to become very 'unobscure'. >
 --------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 389d566...9bea4b2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Oct 11, 2026 2:59a.m.	Review ↗
Shell		Oct 11, 2026 2:59a.m.	Review ↗
Secrets		Oct 11, 2026 2:59a.m.	Review ↗
Docker		Oct 11, 2026 2:59a.m.	Review ↗
Rust		Oct 11, 2026 2:59a.m.	Review ↗
PowerShell		Oct 11, 2026 2:59a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.