TEST-INFRA: [ci-pipeline-design] Add security scanning to Dockerfile.server #10954
No reviewers
Labels
No labels
auto/needs-reevaluation
controller-managed
overdue
auto/blocked-by-deps
auto/ci-timeout
auto/claimed-implementer
auto/claimed-merge
auto/claimed-reviewer
auto/driver-down
auto/invariant-violation
auto/last-attempt-tier-0
auto/last-attempt-tier-1
auto/last-attempt-tier-2
auto/last-attempt-tier-min
Automation Tracking
auto/needs-conflict-resolution
auto/needs-implementer
auto/postmortem
auto/ready-to-merge
auto/restart-throttled
auto/revert
auto/sentinel
auto/stale-inactivity
auto/unstable
Blocked
Bounty
$100
Bounty
$1000
Bounty
$10000
Bounty
$20
Bounty
$2000
Bounty
$250
Bounty
$50
Bounty
$500
Bounty
$5000
Bounty
$750
MoSCoW
Could have
MoSCoW
Must have
MoSCoW
Should have
Needs Feedback
Points
1
Points
13
Points
2
Points
21
Points
3
Points
34
Points
5
Points
55
Points
8
Points
88
Priority
Backlog
Priority
CI Blocker
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Signed-off: Owner
Signed-off: Scrum Master
Signed-off: Tech Lead
Spike
State
Completed
State
Duplicate
State
In Progress
State
In Review
State
Paused
State
Unverified
State
Verified
State
Wont Do
Type
Automation
Type
Bug
Type
Discussion
Type
Documentation
Type
Epic
Type
Feature
Type
Legendary
Type
Refactor
Type
Support
Type
Task
Type
Testing
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
cleveragents/cleveragents-core!10954
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "chore/ci-dockerfile-server-security-scan"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Implemented Trivy-based security scanning for the Dockerfile.server image in the CI pipeline. The scan is configured to fail the build on any HIGH or CRITICAL severity vulnerabilities, preventing insecure images from being deployed to production.
Changes
.forgejo/workflows/ci.ymldocker jobAcceptance Criteria
Dockerfile.serverimage using TrivyHIGHorCRITICALseverity findingsCloses #1927
This PR blocks issue #1927
Automated by CleverAgents Bot
Supervisor: Implementation | Agent: implementation-worker
This PR implements Trivy-based security scanning for the Dockerfile.server image per issue #1927. The implementation correctly addresses all acceptance criteria: Trivy is installed and run after the server image build, configured to fail on HIGH/CRITICAL findings, and scan results are surfaced in CI output.
However, there are several blocking issues that must be addressed before approval:
BLOCKING Issues:
Insecure Trivy installation method: The
curl | shinstall of Trivy has no version pinning and no checksum/signature verification. This creates a supply chain risk — any compromise of the aquasecurity/trivy repo would inject arbitrary code into every CI run. Pin to a specific release tag and verify checksums (e.g., download the checksum signature file from GitHub releases).Missing Robot Framework integration test: Issue #1927 Definition of Done explicitly requires "Tests (Robot): Add integration test verifying the CI pipeline fails on a known-vulnerable image." This is absent.
Changelog not updated: The PR requirements mandate changelog updates with one entry per commit.
ISSUES CLOSED footer missing: Every commit should include
ISSUES CLOSED: #1927in its footer.No Type/ label applied to the PR: Exactly one Type/ label is required for merge.
Non-blocking Suggestions:
CI GATE: unit_tests was failing (8m51s) and coverage was skipped. The underlying CI failures are pre-existing on master and not introduced by this PR. However per company policy all CI gates must pass before merge. These were not caused by the docker job changes.
COMMIT QUALITY: The commit message correctly matches issue #1927 Metadata (
chore(ci): add vulnerability scanning for Dockerfile.server image), but lacks theISSUES CLOSED: #1927footer required by project conventions. Please rebase and amend with the footer.MISSING TEST REQUIREMENT: Issue #1927 DoD requires Robot Framework integration tests ("Tests (Robot): Add integration test verifying the CI pipeline fails on a known-vulnerable image"). These are absent. This is mandatory and must be added.
MISSING PR REQUIREMENTS: Changelog has not been updated per commit. Also missing exactly one Type/ label — required for merge eligibility.
@ -469,1 +469,4 @@- name: Security scan Dockerfile.server image with Trivyrun: |PERFORMANCE SUGGESTION: Trivy (~30MB) is downloaded fresh on every CI run. Consider caching with a Docker layer or reusing the binary across runs.
Alternatively, install it as part of a pre-existing setup step shared by other docker job steps to avoid redundant downloads.
@ -470,0 +472,4 @@run: |# Install Trivyapk add --no-cache curlcurl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/binSECURITY BLOCKER: The Trivy install uses
curl | shwith no version pinning or integrity verification. Any compromise of aquasecurity/trivy repo would inject arbitrary code into every CI run.Suggestion: Pin to a specific Trivy release tag and verify checksums:
Or use the official checksum file from GitHub releases for integrity verification.
@ -0,0 +95,4 @@assert "trivy" in context.workflow_content.lower(), \"Trivy not configured to provide output"The BDD step definitions for Scenario 3 ("Pipeline fails on high-severity vulnerabilities") only check that strings like "trivy" and "docker" appear in the workflow content. They do not verify the actual semantic behavior — e.g., whether
--exit-code 1is paired with the HIGH,CRITICAL flag.For more robust verification, consider checking that
--exit-code 1appears on the same line as the trivy image command.First review completed. See formal review above with inline comments.
Summary: The Trivy security scanning implementation addresses the issue acceptance criteria correctly, but several blocking concerns must be resolved before approval (see detailed in-line comments).
Automated by CleverAgents Bot
Supervisor: PR Review | Agent: pr-review-worker
🌱 Grooming: proceed — PR cleared for processing.
(check
no_duplicates, categoryno_duplicates)Comprehensive scan of 355 open PRs found no duplicates. Anchor PR #10954 uniquely solves adding Trivy-based security scanning to Dockerfile.server with build-blocking logic for HIGH/CRITICAL vulnerabilities. While the repo has numerous test-infra and security-related PRs, none address the same Dockerfile scanning scope. Related security PRs target different threats (env var exfiltration, path traversal, command injection); test-infra PRs focus on tool versioning and performance, not container image security scanning.
📋 Estimate: tier 1.
3 files, +214 LOC. Two distinct CI failures: (1) ruff format violation on new BDD step definitions file — trivial fix; (2) 3 BDD scenarios errored (not failed) in the new ci_dockerfile_server_security_scan.feature — Behave "errored" indicates unhandled exceptions in step implementations, most likely the steps invoke real Docker/Trivy tooling unavailable in the CI environment rather than using proper mocks. Fixing requires understanding the codebase's BDD mocking patterns for CI pipeline tests and rewriting the step implementations accordingly. Multi-file scope, test-infrastructure knowledge required, new logic branches in step definitions — tier 1 standard engineering work.
(attempt #4, tier 1)
🔧 Implementer attempt —
resolved.Pushed 1 commit:
b09d254.Files touched:
.forgejo/workflows/ci.yml,CHANGELOG.md,features/steps/ci_dockerfile_server_security_scan_steps.py,robot/ci_dockerfile_server_security_scan.robot.🌱 Grooming: proceed — PR cleared for processing.
(check
no_duplicates, categoryno_duplicates)PR #10954 adds Trivy-based security scanning to Dockerfile.server in the CI pipeline. Scan of 212 open PRs found no semantic overlap: other security PRs address env-var exfiltration, path traversal, or LSP injection; other CI PRs optimize execution or guard jobs on missing secrets. This PR is a focused, unique infrastructure improvement with no duplicate candidates.
📋 Estimate: tier 1.
Multi-file CI infrastructure change (6 files, +294 LOC) touching the Forgejo workflow YAML plus new BDD feature file and step definitions for security scanning verification. All 13 CI gates are currently failing (lint, typecheck, unit/integration/e2e tests, coverage, build, docker), indicating the implementation has systemic issues requiring cross-file debugging. The BDD test infrastructure addition and CI config changes place this squarely in non-trivial territory. Not tier 0 (mechanical) due to new logic, new tests, and widespread CI failure needing diagnosis. Not tier 2 because there is no architectural coupling, concurrency hazard, or algorithmic complexity — just standard CI pipeline + test scaffolding work that needs to be corrected.
9d26ca53b821c030ff41(attempt #9, tier 1)
🔧 Implementer attempt —
blocked.Blockers:
a2d4000b76but dispatch base was21c030ff41. The implementer pushed from inside the worktree (forbidden by the git contract) OR a third party pushed during the attempt. Re-dispatch will re-prefetch and pick up the new head.a2d4000b766a6cf6fb20(attempt #10, tier 2)
🔧 Implementer attempt —
rebased.Pushed 1 commit:
6a6cf6f.The prior pin used TRIVY_VERSION=0.57.1, but Trivy never published a v0.57.1 tag — the release sequence went v0.57.0 → v0.58.0. The CI docker job consequently failed with `curl: (22) The requested URL returned error: 404` when fetching trivy_0.57.1_Linux-64bit.tar.gz. - Bump TRIVY_VERSION to 0.58.0 (the first stable release after v0.57.0). - Factor the GitHub release base URL into TRIVY_BASE_URL. - Add explicit `set -euo pipefail` so each curl failure surfaces immediately instead of relying on the runner's implicit -e. - Anchor the checksum grep with ` ${TRIVY_TARBALL}$` so a partial filename match cannot smuggle in the wrong checksum line. - Wrap the checksum verification in a subshell so `cd /tmp` does not affect later commands. ISSUES CLOSED: #1927(attempt #12, tier 2)
🔧 Implementer attempt —
blocked.Blockers:
064cb66822but dispatch base wasc9b78f3096. The implementer pushed from inside the worktree (forbidden by the git contract) OR a third party pushed during the attempt. Re-dispatch will re-prefetch and pick up the new head.064cb6682231664726ff31664726ff4cde02c6e4a095ba089203c8e5fa53✅ Approved
Reviewed at commit
f401a8a.Confidence: medium.
Claimed by
merge_drive.py(pid 3311738) until2026-06-18T05:46:53.051294+00:00.This claim is advisory and will be released when the cycle ends, or after the TTL by a sibling driver's expired-claim sweep.
f401a8a5c59805a865cbApproved by the controller reviewer stage (workflow 381).