Skip to content

Rebuild on a fixable CVE of any severity #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
carole-lavillonniere merged 3 commits into from
Oct 22, 2026
Merged

Rebuild on a fixable CVE of any severity #111

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
963a0e6
Rebuild on a fixable CVE of any severity
carole-lavillonniere Oct 21, 2026
f80b786
Say why the rebuild runs on Tuesdays now that secops scans daily
carole-lavillonniere Oct 21, 2026
47f3d90
Drop the cron comment
carole-lavillonniere Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions .github/workflows/security-rebuild.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ name: Weekly Security Rebuild

on:
schedule:
# ~22h ahead of the secops Wednesday 06:00 UTC scan, so anything cleared here is never filed.

@carole-lavillonniere carole-lavillonniere Oct 21, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed this comment since we scan daily now in secops repo

- cron: "0 8 * * TUE"
workflow_dispatch:
inputs:
Expand Down Expand Up @@ -55,7 +54,6 @@ jobs:
with:
image-ref: ${{ env.PUBLISHED_IMAGE }}:${{ steps.version.outputs.tag }}
scanners: vuln
severity: HIGH,CRITICAL
ignore-unfixed: true
format: json
output: published.json
Expand All @@ -64,7 +62,7 @@ jobs:
id: before
run: |
jq -r '[.Results[]?.Vulnerabilities[]?.VulnerabilityID] | unique | .[]' published.json | sort -u > published_cves.txt
echo "Fixable HIGH/CRITICAL CVEs on the published image:"; cat published_cves.txt || true
echo "Fixable CVEs on the published image:"; cat published_cves.txt || true
if [ -s published_cves.txt ]; then
echo "proceed=true" >> "$GITHUB_OUTPUT"
else
Expand Down Expand Up @@ -92,7 +90,6 @@ jobs:
with:
image-ref: localstack-docker-desktop:candidate
scanners: vuln
severity: HIGH,CRITICAL
ignore-unfixed: true
format: json
output: candidate.json
Expand Down Expand Up @@ -182,7 +179,7 @@ jobs:
echo "### Weekly security rebuild"
echo
echo "- Published image: \`${PUBLISHED_IMAGE}:${{ steps.version.outputs.tag }}\`"
echo "- Fixable HIGH/CRITICAL on the published image: $(wc -l < published_cves.txt 2>/dev/null || echo 0)"
echo "- Fixable CVEs on the published image: $(wc -l < published_cves.txt 2>/dev/null || echo 0)"
echo "- Cleared by rebuild: $(wc -l < cleared.txt 2>/dev/null || echo 0)"
echo "- Released: ${{ steps.bump.outputs.version || 'no (nothing cleared)' }}"
} >> "$GITHUB_STEP_SUMMARY"
Loading