[code sync] Merge code from sonic-net/sonic-buildimage:202511 to 202603 - #2866
Merged
Conversation
mssonicbld
commented
Aug 5, 2026
mssonicbld
commented
Collaborator
…rom master (#28537) * [202511] Backport docker-sonic-mgmt image and pipeline from master Align the docker-sonic-mgmt image (Dockerfile.j2 and the ansible getattr patch) and its build pipeline (.azure-pipelines/docker-sonic-mgmt.yml) with master. SBOM generation/scan is intentionally left out because 202511 does not carry the SBOM build machinery (the SBOM feature #27455 was never backported to this branch). The pr_test_template call drops INCLUDE_JOBS because sonic-mgmt@202511's pr_test_template.yml does not declare that parameter (job selection there is impacted-area driven). Branch-specific fields (schedule/pr branch filters and the sonic-mgmt resource ref) target 202511, and the published image is tagged with the branch name (docker-sonic-mgmt:202511 and :202511-lastbuild) instead of :latest/:lastbuild so it never overwrites master's published mgmt image. Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * [202511] ci: add Trivy vulnerability scan for docker-sonic-mgmt 202511 does not carry the SBOM-based vulnerability scan (scripts/sbom_*.py are master-only). Reuse the branch's existing self-contained Trivy scan (already used by docker-ptf.yml on 202511) for docker-sonic-mgmt: a new optional trivy_scan job downloads the built image artifact, installs Trivy, and scans it for MEDIUM/HIGH/CRITICAL vulnerabilities. Only the pipeline YAML changes; no repo scripts are required. Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
Author
|
/azp run |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
… (#28852) The trivy_scan job declared "dependsOn: Build", but a job level dependsOn can only reference another job within the same stage, and Build is a stage. SecurityScan was therefore left without any job that could start it, and the pipeline failed to compile with: Stage SecurityScan must contain at least one job with no dependencies. The stage level "dependsOn: Build" already orders SecurityScan after the build, so the job level one is dropped. Signed-off-by: Lun Yue <17232861+lunyue-ms@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 81b1889d-9ef5-43c8-be2e-d78ab1bd5764
mssonicbld
force-pushed
the
sonicbld/202603-merge
branch
from
August 6, 2026 03:03
aa99d52 to
7121543
Compare
Collaborator
Author
|
/azp run |
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.