Fix weekly rebuild - #101
Open
carole-lavillonniere wants to merge 2 commits into
Open
Conversation
Yesterday's rebuild cleared CVE-2026-14456 and published 2026.9.0, and the scan refiled that same CVE this morning (BEE-1172, BEE-1173). It never looked at the rebuilt image: secops resolves this product from our last two GitHub *releases* (localstack/secops, localstack_products.json: type=github, github_releases_fetch_limit=2), looking each release's tag_name up verbatim on Docker Hub. We pushed a bare git tag and no release, so the scan window stayed on v2026.8.0 -- and Docker Hub had no v2026.9.0 tag for it to resolve either, since the publish step minted only the bare version. So: publish v${NEW} alongside ${NEW}, and cut the release. Also move latest, which nothing in the scan reads but `docker pull` and the marketplace do -- it still points at the superseded 2026.8.0. type=sha stays dropped: the candidate is built from the commit before the version bump. This does not stop a *new* Alpine CVE being ticketed. localstack_products.json still has docker-desktop as rebuild_model=on-release, so classify_findings.py rule 3 tickets OS-layer findings instead of leaving them to the rebuild; that entry wants flipping to scheduled now that this workflow exists. Also SHA-pin build-push-docker.yml's five actions, at the versions Dependabot proposes in #100 -- that file has always used floating tags, and it is the one holding the Docker Hub credentials. Both tags already ship provenance attestations, so the major bumps do not change the published index shape.
carole-lavillonniere
force-pushed
the
cosy-926-release-visibility
branch
from
September 2, 2026 08:19
53a3eee to
0f7e5fc
Compare
carole-lavillonniere
changed the title
carole-lavillonniere
marked this pull request as ready for review
September 2, 2026 08:28
Pive01
reviewed
Sep 2, 2026
Collaborator
There was a problem hiding this comment.
Question: now though wouldn't build-push-docker.yml get triggered again and try to push a tag that has already been published by the Publish (multi-arch) step?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #99.
The PR forgot to create a github release and to tag the new image with
latestandv{version}Changes
v${NEW}andlatestalongside${NEW}.v${NEW}is the one the scan resolves;latestis fordocker pulland the marketplace, which were still being served the superseded 2026.8.0.type=shastays dropped — the candidate is built from the commit before the version bump, sosha-*would point at the wrong tree.gh release createafter the tag push, so the scan window actually advances. Ordered after the publish deliberately: the Docker Hub tag has to exist before a release points at it.build-push-docker.yml's five actions. Somewhat unrelated to the other changes here but it is the recommended way to pin actions, as dicussed in Weekly rebuild + Dependabot #99.Already applied by hand, so this week clears
v2026.9.0andlatestretagged onto the 2026.9.0 index (sha256:93176748…) — by digest, no rebuild