nevzheng opened a new pull request, #13156:
URL: https://github.com/apache/gravitino/pull/13156
### What changes were proposed in this pull request?
Add repository-wide advisory container-image monitoring. The weekly/manual
workflow discovers references from tracked Dockerfiles, Compose, CI
declarations,
Java/Testcontainers and Gradle defaults, Helm defaults and Docker helper
scripts,
then retains a per-image inventory and Syft/Grype vulnerability report.
All findings, missing coverage and scan failures are warnings only. The
workflow
has no PR/push trigger, no merge gate and no issue/comment writes.
Dependabot gains
Docker and recursive Compose coverage for supported manifests. This PR is
independent of the RustFS migration and discovers its manifest when present.
### Why are the changes needed?
Existing dependency monitoring did not cover container images; add
repository-wide advisory coverage. The initial inventory resolves 41 unique
registry references and records 17 runtime, template or local-build
declarations
that cannot be fully resolved. Source-code literals and computed references
do
not gain automatic version-update coverage merely because they are scanned.
The maintainer guide documents scan limits and an optional future design for
one
deduplicated rolling issue per affected image repository. Automatic ticket
filing
is not enabled or implemented. The workflow uses ASF-approved action hashes
and
only `contents: read`.
Related to #13154.
### Does this PR introduce _any_ user-facing change?
No runtime/API changes. Maintainers receive advisory reports and ordinary
Dependabot update PRs; existing integration checks still validate actual
updates.
### How was this patch tested?
- 25 Python tests cover actual declaration patterns, nested Compose defaults,
Docker stage/COPY handling, Java/Gradle references, Helm templates, source
deduplication, runtime gaps and warning-only exit behavior.
Workflow-contract
tests verify no PR/push gate or issue-write permission.
- `actionlint`, Dependabot YAML inspection, `git diff --check`, project
`spotlessApply` and Python formatting passed.
- Live repository discovery found 41 unique references across nine
Dockerfiles,
five Compose files, CI service/test/default declarations, three Helm
charts and
two Docker helper scripts. The inventory includes the external uv COPY
image.
- Syft 1.51.1 and Grype 0.118.0 scanned the declared Ubuntu 22.04 amd64
image:
101 packages and 86 matches (60 medium, 18 low, 8 negligible). The new
reporter
recorded digest
`sha256:281c5745f657873d78e5531fc5ba8575f46ab7769b94550ac99543f122679986`,
emitted a warning and returned exit status 0. Critical/unfixed findings and
missing/failed scans also return advisory success in regression tests.
The complete hosted 41-image sweep and hosted Dependabot execution have not
run
locally. Registry availability and metadata coverage can differ by image; the
workflow reports those gaps and does not claim complete embedded dependency
or
runtime-image coverage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
