ci: unify Dependabot, Trivy and Docker Scout behind one gate, report and alert

[zeevmoney]

Linear: PER-15358

Stacked on #338 (base: ci/continuous-image-vuln-scanning). Merge #338 first.

#338 made the CVE gate run on releases and added a scheduled re-scan of the published tags. This PR gives all three scanners — Dependabot, Trivy, Docker Scout — the same treatment: a PR gate with a readable report, alerts that reach Slack, and a release gate with teeth. It adopts the pattern from permitio/agent-security's dependency-review.yml.

What each scanner does now

	PR gate	Scheduled alert	Release gate
Trivy	blocks, in the sticky comment	published tags, in the shared digest	scans the shipped tag by digest, both platforms
Docker Scout	blocks, same comment	latest, same digest	same job
Dependabot	new dependency-review job	alerts API poll, same digest	—

PR gate and report

The Trivy step moves from exit-code: 1 to scan-to-JSON → format → a separate fail step, so findings exist as a file and can be reported rather than living only in a step log. The gate does not weaken: severity, trivyignores, ignore-unfixed and vuln-type carry over byte-identical, so critical + high > 0 is the old predicate evaluated two steps later — plus three report-unreadable failure modes the old exit code could not express.

One sticky comment per PR, marker <!-- pdp-image-scan -->, covering Trivy and Scout together. Scout's own write-comment goes to false on both steps, so a PR gets at most two bot comments instead of three. Guards for fork PRs and Dependabot PRs (read-only token there), with $GITHUB_STEP_SUMMARY and one ::error:: per finding as fallbacks.

One schedule, one message

scheduled-security-scan.yml runs all three scanners as parallel jobs on 17 6 */3 * * and a digest job merges them:

*Trivy* - 2 published tag(s): 1 clean, 1 not clean.
  • permitio/pdp-v2:latest -> SOURCE (3 findings: 1 CRITICAL, 2 HIGH)
  • permitio/pdp-v2:v0.9.15 -> CLEAN
*Docker Scout* - found 3 unwaived CRITICAL/HIGH finding(s) in permitio/pdp-v2:latest...
*Dependabot* - 1 new unwaived CRITICAL alert: CVE-2026-99999 in requests.

They ran on separate crons at first, each sending its own message, so one CVE produced three notifications on the same morning — three scanners agreeing, which reads as three problems. The digest keys each scanner on its job result, not its finding count: Scout exports a body on the clean path too, so the body alone cannot tell "the gate passed" from "the gate never ran", and a scanner that did not run must not read as clean. status only escalates ok → warn → fail.

The Dependabot leg filters through .trivyignore.yaml, and this is load-bearing. All three currently-open HIGH alerts (CVE-2026-50271, CVE-2026-54283, CVE-2026-48818) are CVEs already waived there. An unfiltered feed would repeat the same three every run until the channel was muted. Verified against the live feed: 6 open → 3 at critical/high → 0 reported, 3 recognised as waived. Consequence worth knowing: adding a waiver also silences its Dependabot alert.

There is no dependabot_alert workflow trigger, so that leg is a poll. It reports a delta over a 73-hour window (72 + 1h overlap) and the standing backlog, so a run GitHub drops does not lose that day permanently.

Release gate

New verify-published-image job scans the tag that actually shipped, by digest, per platform — the only place linux/arm64 is ever scanned, since tests.yml builds amd64 only. update-pdp-api-ecs-service now lists it in needs:, so an unwaived CRITICAL/HIGH in a freshly published image stops the rollout. It runs after the push, so it cannot un-publish the tag; what it prevents is rolling that image to the fleet.

Supporting changes

• format_scan_report.py, check_waiver_parity.py, check_dependabot_alerts.py — 81 tests in horizon/tests/, which is the path the required pytests job actually runs.
• classify_image_cves.py now fails closed. A zero-byte report was reported as CLEAN with exit 0; it now exits 2 with verdict=ERROR.
• Waiver parity gap closed, 5 → 7 (CVE-2026-48710, CVE-2026-48817 were VEX-only), and enforced by a waiver-parity pre-commit hook rather than a comment.
• notify-slack.yml — reusable notifier, a green no-op with a ::notice:: until SLACK_WEBHOOK_URL exists, and it reports its own delivery failures.
• The rolling [image-cve] GitHub issue is removed, not deprecated.
• PyYAML declared; it was reaching a required check only via uvicorn[standard].

Verification

• actionlint: 8 findings, all pre-existing — zero introduced, one cleared vs the baseline.
• zizmor: clean on every new workflow; 17 pre-existing findings cleared across the branch.
• 81 tests pass; every mutation applied during review was caught.
• pre-commit run --all-files: all 17 hooks pass.
• All 10 action pins re-resolved live against the API — zero version comments that disagree with their SHA.
• Gate strength re-derived independently by extracting the real run: bodies and driving them over 13 fixtures; the merged digest over 12 more.

Before this does anything

1. SLACK_WEBHOOK_URL does not exist. Every Slack path is a green no-op until it does. A green notify job proves nothing on its own — look for the ::notice::.
2. Copy CLONE_REPO_TOKEN, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN into the Dependabot secret store. That store is empty, so build-pdp-image fails on every Dependabot PR and takes pdp-tester and docker-scout with it — the image gate does not run on the PRs it exists for. Pre-existing, not introduced here.
3. Create the dependencies label. ci: CVE-gate PRs, releases and published images; harden workflows and credentials (PER-15358) #338's dependabot.yml sets it; the repo has only the nine defaults, so those PRs arrive unlabeled.
4. Unproven assumption: that Scout resolves registry://permitio/pdp-v2:latest to the PURL pkg:docker/permitio/pdp-v2@latest. Docker's docs say it does. If not, all 7 waivers stop suppressing. One workflow_dispatch after merge settles it.

Known gap, documented rather than fixed

dependency-review is a third waiver surface that does not read .trivyignore.yaml, so a PR touching the starlette or ddtrace pins can be failed on an already-waived advisory. check_waiver_parity.py covers 2 of 3 surfaces.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VvR24Cibs2Z8cVsEqkp3Es

[zeevmoney]

Closing — not stacking. These commits go onto #338's branch directly.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

PDP image vulnerability report

Image: permitio/pdp-v2:next

✅ No CRITICAL or HIGH findings after waivers.

Trivy

No CRITICAL or HIGH findings.

Docker Scout

No CRITICAL or HIGH findings.

---

Scanned by Trivy, Docker Scout. Waivers: .trivyignore.yaml + .docker/scout/pdp-v2.vex.json. View run