Follow-up to #370 item 4: "For image scan: on `main` pushes + release tag pushes, scan the published image too."
The parent PR lands trivy in docker-smoke.yml, which only runs on PRs that touch the Dockerfile / pyproject.toml / uv.lock / .dockerignore. This covers "catch new CVEs introduced by a PR" but not:
- Main-branch drift: a fix releases upstream that closes a CVE in our base image — the image on main gradually becomes out of date without anyone noticing until the next Dockerfile-touching PR.
- Published-image regressions:
docker-publish.yml fires on release tags and pushes the image to GHCR. No scan runs between build and publish.
Scope
- Scheduled scan on
main: new workflow trivy-main.yml or extend docker-smoke.yml with a nightly schedule: trigger that pulls main, builds the image, and runs trivy with the same policy. On failure, file an issue automatically (or at least emit a check status so it's visible on the commit view).
- Post-publish scan: add a trivy step to
docker-publish.yml that scans the published image (same policy: HIGH/CRITICAL, --ignore-unfixed). Failure should at minimum emit a warning annotation and a SARIF upload so the Security tab surfaces the CVEs on published artifacts.
Acceptance
References
Follow-up to #370 item 4: "For image scan: on `main` pushes + release tag pushes, scan the published image too."
The parent PR lands trivy in
docker-smoke.yml, which only runs on PRs that touch the Dockerfile / pyproject.toml / uv.lock / .dockerignore. This covers "catch new CVEs introduced by a PR" but not:docker-publish.ymlfires on release tags and pushes the image to GHCR. No scan runs between build and publish.Scope
main: new workflowtrivy-main.ymlor extenddocker-smoke.ymlwith a nightlyschedule:trigger that pullsmain, builds the image, and runs trivy with the same policy. On failure, file an issue automatically (or at least emit a check status so it's visible on the commit view).docker-publish.ymlthat scans the published image (same policy: HIGH/CRITICAL,--ignore-unfixed). Failure should at minimum emit a warning annotation and a SARIF upload so the Security tab surfaces the CVEs on published artifacts.Acceptance
docker-publish.ymlscans the published image and uploads SARIFdocker-smoke.yml(HIGH/CRITICAL,--ignore-unfixed)References