codeant-ai-for-open-source[bot] commented on code in PR #44035:
URL: https://github.com/apache/superset/pull/44035#discussion_r3963462828
##########
.github/workflows/docker.yml:
##########
@@ -213,6 +219,31 @@ jobs:
docker images $IMAGE_TAG
docker history $IMAGE_TAG
+ # Scan the built image for known vulnerabilities and publish results
+ # to the Security tab. Trivy did this until #38780 removed it: both
+ # aquasecurity/trivy-action and the trivy binary itself were
+ # compromised (twice) to steal GitHub Secrets from CI runs. Grype is a
+ # different tool from a different maintainer with no shared supply
+ # chain, and is already on the ASF Infra GitHub Actions allowlist.
+ - name: Scan built image for vulnerabilities
+ if: github.event_name == 'push' && github.ref == 'refs/heads/master'
&& matrix.build_preset == 'lean'
+ id: grype-scan
+ uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 #
v7.4.2
+ with:
+ image: ${{ env.IMAGE_TAG }}
+ output-format: sarif
+ severity-cutoff: high
+ only-fixed: true
+ # Informational only, matching the prior Trivy setup: this
+ # workflow does not gate merges on scan findings.
+ fail-build: false
+
+ - name: Upload vulnerability scan results to GitHub Security tab
+ if: github.event_name == 'push' && github.ref == 'refs/heads/master'
&& matrix.build_preset == 'lean'
+ uses:
github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 #
v4.37.9
+ with:
+ sarif_file: ${{ steps.grype-scan.outputs.sarif }}
Review Comment:
**Suggestion:** Although the scan is informational, an upload failure makes
the required `docker-build` job fail when GitHub rejects the SARIF or the file
is missing. [error handling]
**Assessment:** ๐ `Major` ยท ๐ `Occurrence: Rarely`
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=f4940739a067464abe49d253ad907507&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=f4940739a067464abe49d253ad907507&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** .github/workflows/docker.yml
**Line:** 241:245
**Comment:**
*Error Handling: Although the scan is informational, an upload failure
makes the required `docker-build` job fail when GitHub rejects the SARIF or the
file is missing.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44035&comment_hash=371f4a3e58766788bc06afcbd81b0b77e323535c96b3c18859d249167618e123&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44035&comment_hash=371f4a3e58766788bc06afcbd81b0b77e323535c96b3c18859d249167618e123&reaction=dislike'>๐</a>
##########
.github/workflows/docker.yml:
##########
@@ -213,6 +219,31 @@ jobs:
docker images $IMAGE_TAG
docker history $IMAGE_TAG
+ # Scan the built image for known vulnerabilities and publish results
+ # to the Security tab. Trivy did this until #38780 removed it: both
+ # aquasecurity/trivy-action and the trivy binary itself were
+ # compromised (twice) to steal GitHub Secrets from CI runs. Grype is a
+ # different tool from a different maintainer with no shared supply
+ # chain, and is already on the ASF Infra GitHub Actions allowlist.
+ - name: Scan built image for vulnerabilities
+ if: github.event_name == 'push' && github.ref == 'refs/heads/master'
&& matrix.build_preset == 'lean'
Review Comment:
**Suggestion:** This condition never runs for workflow-only pushes because
`docker-build` is gated by change-detector outputs that do not classify this
workflow file. [incorrect condition logic]
**Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes`
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=f00e147f823c47d9810514871f79551c&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=f00e147f823c47d9810514871f79551c&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** .github/workflows/docker.yml
**Line:** 229:229
**Comment:**
*Incorrect Condition Logic: This condition never runs for workflow-only
pushes because `docker-build` is gated by change-detector outputs that do not
classify this workflow file.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44035&comment_hash=900b3bd5f6ed068422dbfbc5bab20670bcf768d7d66b112f88f504450cc64c82&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44035&comment_hash=900b3bd5f6ed068422dbfbc5bab20670bcf768d7d66b112f88f504450cc64c82&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
