feat(ci): add trivy_skip_dirs and trivy_skip_files inputs to publish-template-image #27

2026-06-01T03:37:19Z

core-be commented

2026-06-01 03:37:19 +00:00

No description provided.

core-be added 9 commits 2026-06-01 03:37:20 +00:00

docs(readme): add publish-template-image.yml section c90b0095d3

The README documents the four validator workflows but omits
publish-template-image.yml — which is arguably the most consequential
workflow in this repo (it's the GHCR publish gate that would have
caught the 2026-04-27 RuntimeCapabilities outage if it had existed
then, and is what the runtime-publish cascade fans out to today).

Adds:
- Caller-side usage example matching the validator-section format
- Trigger table (push/dispatch/cascade) verified against the workflow's
  consumers in the template repos
- Inputs table (runtime_name, runtime_version) verified against the
  workflow's on.workflow_call.inputs block
- Pipeline order: lint → static import smoke → boot smoke → push,
  with the load-bearing detail that GHCR push only happens after
  all three gates pass
- Smoke timeout calibration explainer (90s inner / 120s outer) with
  link to PR #33 and the wedge-coverage rationale, so future readers
  don't lower the timeouts and silently blind the gate
- Cross-link to molecule-core/workspace/smoke_mode.py and to
  publish-runtime.yml for the cascade trigger

Doc-only. No workflow or code changes.

Merge pull request #34 from Molecule-AI/docs/readme-add-publish-template-image-section fc63cb41b3

docs(readme): add publish-template-image.yml workflow section

feat(ci): add Trivy HIGH/CRITICAL gate before image push (RFC #388 PR-2) c542493572

Belt-and-suspenders security gate inserted between boot-smoke and
push-to-GHCR. Fails the publish on any HIGH or CRITICAL CVE in either
the OS layer (apt deps) or the Python layer (pip deps). Image never
reaches :latest if vulnerable, so no fresh workspace provision can
pick up a known-bad layer.

Why pre-push: same logic as boot-smoke — anything that fails here
never poisons :latest. Catching post-push leaves a window where
every fresh provision pulls the vulnerable image.

Why HIGH+CRITICAL only with ignore-unfixed=true: medium/low findings
are too noisy in practice (~hundreds per Ubuntu base, mostly
operationally non-actionable until the next Canonical respin).
Promoting those to gate would drown signal in noise. Once
Dockerfiles digest-pin their base image (RFC #388 PR-2 second
half), this becomes the matched pair: pin avoids surprise base-bumps;
Trivy catches if the pinned digest itself accumulates fixable vulns.

Applies to all 4 supported template repos automatically since they
all consume this reusable workflow (claude-code, hermes, openclaw,
codex per PR #2536 prune set).

Refs: https://github.com/Molecule-AI/molecule-controlplane/issues/388

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge pull request #35 from Molecule-AI/feat/trivy-image-scan 792a8aaba8

feat(ci): add Trivy HIGH/CRITICAL gate before image push (RFC #388 PR-2)

fix(publish): bump trivy-action 0.28.0 → 0.36.0 (0.28.0 yanked from registry) dc60485c04

aquasecurity/trivy-action@0.28.0 was removed from the GitHub Actions
registry. Every workspace template's publish-image run is now red:

  Unable to resolve action `aquasecurity/trivy-action@0.28.0`,
  unable to find version `0.28.0`

Pin to 0.36.0 (current latest, matches the GHA marketplace listing).
Same step config — only the version tag changes. Validated via:

  python3 -c "import yaml; yaml.safe_load(open('publish-template-image.yml'))"

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge pull request #36 from Molecule-AI/fix/trivy-action-pin-bump 7c1242b7df

fix(publish): bump trivy-action 0.28.0 → 0.36.0 (0.28.0 yanked from registry)

fix(publish): trivy-action tag needs v prefix — bump 0.36.0 → v0.36.0 c4a4083f45

aquasecurity/trivy-action moved to v-prefixed tags. The non-v 0.36.0
doesn't exist (only v0.36.0 + a legacy non-v 0.35.0). Followup to #36
which used the non-v form and still failed:

  Unable to resolve action `aquasecurity/trivy-action@0.36.0`,
  unable to find version `0.36.0`

Verified: `gh api repos/aquasecurity/trivy-action/tags` returns
v0.36.0, v0.35.0, v0.34.0, etc.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge pull request #37 from Molecule-AI/fix/trivy-action-v-prefix b8ca507fb8

fix(publish): trivy-action tag needs v prefix — bump 0.36.0 → v0.36.0

feat(ci): add trivy_skip_dirs and trivy_skip_files inputs to publish-template-image b12f1617ba

Adds per-template skip-dirs/skip-files inputs to the reusable
publish-template-image workflow, forwarded to the Trivy action.

This avoids the maintenance burden of large .trivyignore files
(110 CVEs in template-hermes) by letting callers exclude paths
that carry upstream-bundled binary distributions.

Fixes #39

claude-ceo-assistant commented

2026-06-11 20:25:47 +00:00

Triaged + closed to clear backlog: CI-pending 10+ days, no activity. Reopen if still wanted.

claude-ceo-assistant closed this pull request

2026-06-11 20:25:48 +00:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-ci#27