Skip to content

Demo: block an intentionally vulnerable container release - #74

Open
DevOpsAIguru123 wants to merge 28 commits into
mainfrom
agent/container-image-release-advisor
Open

Demo: block an intentionally vulnerable container release#74
DevOpsAIguru123 wants to merge 28 commits into
mainfrom
agent/container-image-release-advisor

Conversation

@DevOpsAIguru123

@DevOpsAIguru123 DevOpsAIguru123 commented Jul 28, 2026

Copy link
Copy Markdown
Owner

What changed

  • adds a self-contained policy-driven container image release advisor
  • provides independent Google ADK/Vertex AI and Claude Agent SDK/Sonnet 5 workflows
  • combines SonarCloud code analysis, pre-build Trivy misconfiguration scanning, exact-image vulnerability and secret scanning, deterministic release policy, protected approval, and Docker Hub publishing
  • produces pre-build, image-security, and consolidated HTML/PDF reports
  • adds a numbered architecture diagram using documented vendor brand assets
  • adds five-minute setup, authentication/WIF, successful and blocked demos, and production-readiness guidance

Security boundary

The AI advisor is informational only. It cannot approve, reject, waive, publish, or change the deterministic release policy. policy_decision: not_evaluated is never treated as approval.

No credentials, account IDs, generated reports, caches, session databases, or machine-local paths are included. GitHub Actions are SHA-pinned, and Trivy secret scanning reports no findings.

Configuration note

The two release workflows use workflow_dispatch by default because this repository does not yet have the documented SonarCloud, model-provider, Docker Hub, and protected-environment settings. Enable pull_request or push triggers only after completing the included setup guide.

Validation

  • catalog validation: 79 entries
  • repository tests: 72 passed
  • ADK unit tests: 28 passed
  • Claude adapter tests: 11 passed
  • workflow YAML parsing passed
  • shell syntax and SVG validation passed
  • action SHA pinning check passed
  • staged credential/local-reference checks passed
  • Trivy filesystem secret scans passed for the agent and workflow files

Vinod V and others added 4 commits July 28, 2026 17:22
Vinod V
add container image release advisor
6b3e6a8
@dependabot
chore(deps): bump hashicorp/google (#75)
3e22ea6 
Bumps the non-breaking-updates group in /agents/adk/terraform-plan-reviewer/terraform/gcs-sample with 1 update: [hashicorp/google](https://github.com/hashicorp/terraform-provider-google).


Updates `hashicorp/google` from 7.41.0 to 7.42.0
- [Release notes](https://github.com/hashicorp/terraform-provider-google/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-google@v7.41.0...v7.42.0)

---
updated-dependencies:
- dependency-name: hashicorp/google
  dependency-version: 7.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: non-breaking-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@DevOpsAIguru123 tuximac
test: require https catalog urls (#76)
4639832 
Co-authored-by: tuximac <tuximac@tuximacs-MBP.hsd1.tx.comcast.net>
Vinod V
test ADK pipeline on pull requests
7164bea
@github-advanced-security

github-advanced-security AI commented Jul 29, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Vinod V added 20 commits July 29, 2026 14:05
Vinod V
make Claude the default PR advisor
dd291fe
Vinod V
simplify Claude advisory report
a981f3c
Vinod V
clarify human release approval status
802cb62
Vinod V
order release summary and link artifacts
3aea7c5
Vinod V
demonstrate blocked vulnerable release
eec3c6c
Vinod V
continue blocked demo for full security evidence
f8c2a2a
Vinod V
collect complete security evidence before gating
d2ef9f4
Vinod V
accept bounded triage identifiers in Claude review
ffab0da
Vinod V
place Claude review after deterministic summary
eaacaea
Vinod V
clarify consolidated report for readers
6938439
Vinod V
deliver security reports by email and Discord
3ecf455
Vinod V
retry transient Claude advisory failures
bfd44b8
Vinod V
bound Claude provider retries with timeouts
e44dee7
Vinod V
retry Claude subprocess failures three times
b801e53
Vinod V
isolate Claude retries in bounded processes
8d99a3c
Vinod V
fix Claude retry shell parsing
38ccab7
Vinod V
fallback to bounded Anthropic API transport
3d447d6
Vinod V
shorten Claude SDK circuit breaker
ec97c28
Vinod V
render fallback report in project environment
c06f4e8
Vinod V
update container release architecture diagram
4a69567
@DevOpsAIguru123 DevOpsAIguru123 mentioned this pull request Jul 30, 2026
Merged
@DevOpsAIguru123 DevOpsAIguru123 changed the title Add container image release advisor Demo: block an intentionally vulnerable container release Jul 30, 2026
@DevOpsAIguru123

DevOpsAIguru123 commented Jul 30, 2026

Copy link
Copy Markdown
Owner Author

This PR is preserved as the isolated findings demonstration. It intentionally exercises SonarQube and Trivy against an unsafe release candidate so the screenshots and Actions evidence show the deterministic BLOCKED outcome.

Reusable production code is now proposed separately in #78. That PR removes deployable vulnerable fixtures, fixes workflow selection to the hardened assets, and retains fail-closed coverage through synthetic policy tests. Do not merge this demonstration PR into a release branch.

@DevOpsAIguru123
DevOpsAIguru123 marked this pull request as ready for review July 30, 2026 20:14
@DevOpsAIguru123
Add production-ready container image release advisor (#78)
bc9082f 
* add container image release advisor

* test ADK pipeline on pull requests

* make Claude the default PR advisor

* simplify Claude advisory report

* clarify human release approval status

* order release summary and link artifacts

* demonstrate blocked vulnerable release

* continue blocked demo for full security evidence

* collect complete security evidence before gating

* accept bounded triage identifiers in Claude review

* place Claude review after deterministic summary

* clarify consolidated report for readers

* deliver security reports by email and Discord

* retry transient Claude advisory failures

* bound Claude provider retries with timeouts

* retry Claude subprocess failures three times

* isolate Claude retries in bounded processes

* fix Claude retry shell parsing

* fallback to bounded Anthropic API transport

* shorten Claude SDK circuit breaker

* render fallback report in project environment

* update container release architecture diagram

* harden container advisor distribution

* add Sonar coverage and path safeguards

* trace subprocess policy coverage

* scope coverage to deterministic security core
@sonarqubecloud

sonarqubecloud Bot commented Jul 30, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@sonarqubecloud

sonarqubecloud Bot commented Jul 30, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@DevOpsAIguru123 @github-advanced-security