From c90c8c621d2d48e792c34247aa614d93085e9cd5 Mon Sep 17 00:00:00 2001 From: Pol Alzina Date: Mon, 9 Nov 2026 18:49:33 +0100 Subject: [PATCH] Scan the published image instead of a fresh build A fresh build now runs apk upgrade, so it always has the latest Alpine fixes and the scan passes even while the image on Docker Hub is still vulnerable. Scan the published image, which is what users run, so a fix waiting for a release gets noticed. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/scan.yml | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index 57e5a40..3e6bfc4 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -1,36 +1,25 @@ name: Image scan -# Alpine package fixes only reach users with a new release. A weekly scan -# of a fresh build fails (and notifies) when a fixable high or critical -# vulnerability is waiting for one. +# Scans the image people actually run: the one published on Docker Hub, not +# a fresh build. A vulnerability can appear without any commit here, and a +# fix only reaches users with a new release, so this fails (and notifies) +# when a fixable high or critical vulnerability is waiting for one. on: schedule: - cron: "17 6 * * 1" workflow_dispatch: -permissions: - contents: read +permissions: {} jobs: scan: - name: Scan the image for fixable vulnerabilities + name: Scan the published image for fixable vulnerabilities runs-on: ubuntu-latest steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - name: Build image - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 - with: - context: . - load: true - pull: true - tags: filesync:scan - name: Scan uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2 with: - image: filesync:scan + image: poliuscorp/filesync:latest fail-build: true severity-cutoff: high only-fixed: true