container-scan.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: container-scan

# Builds the optional ciphertext-only sync relay image and scans it for known
# OS/library CVEs with Trivy. The relay carries no third-party dependencies, so
# any finding here comes from the base image — keeping it on the gate means a
# newly-disclosed CVE in python:slim blocks the merge (and the weekly run catches
# CVEs disclosed against an already-merged image). Threshold is CRITICAL,HIGH per
# docs/standards/SECURITY-AND-SUPPLY-CHAIN-STANDARD.md §6.3, with no ignore file:
# a finding is cleared by patching it, not by waiving it.
#
# The image applies Debian security updates over its pinned base digest, so a
# finding clears on the next build once Debian publishes a fix, without waiting
# for upstream to rebuild python:slim. That is not optional tidiness — see
# relay/Dockerfile: as of 2026-08-17 the newest published python:3.14-slim digest
# still shipped a util-linux fixed in Debian, so a digest bump alone could not
# clear it. What this gate cannot fix is a CVE Debian has not fixed either; that
# is a real block, and the answer is a base change, not an exception.

# CICD-§11e: the PR run gates the merge and the weekly schedule catches CVEs
# disclosed after merge — a push:main run would rebuild and rescan the identical
# image minutes after its PR run, so it carries no additional signal.
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: "41 4 * * 1" # weekly, Monday 04:41 UTC (DB-freshness re-scan)
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: container-scan-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    name: Trivy image scan (relay)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Buildx with an archive-capable builder
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Build the relay image
        # --no-cache is load-bearing now that the image applies Debian security
        # updates at build time: a cached `apt-get upgrade` layer would let Trivy
        # scan a package set captured from some earlier archive state and report
        # it as today's. Hosted runners start cold, so this costs a few seconds
        # and removes the assumption rather than relying on it.
        run: docker build --no-cache -f relay/Dockerfile -t habitable-relay:scan .
      - name: Verify byte-identical relay OCI rebuilds
        run: make relay-repro
      - name: Scan the image (Trivy — fail on HIGH,CRITICAL)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: image
          image-ref: habitable-relay:scan
          severity: HIGH,CRITICAL
          exit-code: "1"
          ignore-unfixed: true
          vuln-type: os,library
          format: table