feat(ci): dispatchable read-only CVE measurement across every image

ryangr0 commented

2026-08-08 06:41:59 +00:00

Owner

One run, every ops/docker image, the same cve-gate binary the release path uses, against the digest each image's highest semver tag resolves to in Harbor today. Builds nothing, releases nothing, always exits green.

Ran today as run 272. What it surfaced (partial, still running at PR time):

image	tag	critical	high
act-runner	1.2.2	40	123
agent-runner	1.0.3	43	105
ci-runner	1.2.3	15	106
cve-gate	0.3.4	0	0 (1 VEX-suppressed)
helm-deploy	1.2.2	21	105
mkdocs-runner	1.0.2	125	474

Two conclusions already:

The techdocs chain, not ci-runner, is the estate's worst surface — 125/474 against ci-runner's 15/106. Its parents sat on unwatched alpine3.20/Java-11 digests (#115 makes them Renovate-visible).
These are stale-tag numbers. The estate runs artifacts built against bases that have long moved on. Budgets should be set from the FRESH numbers the pin-train releases (#107–#116) produce, not from these.

On main this becomes workflow_dispatch-able: re-measure the whole estate any time without touching the release path. cve-budgets.yaml says budgets are measured by the pipeline — this is the instrument.

Generated with Claude Code

One run, every ops/docker image, the same cve-gate binary the release path uses, against the digest each image's highest semver tag resolves to in Harbor today. Builds nothing, releases nothing, always exits green. Ran today as run 272. What it surfaced (partial, still running at PR time): | image | tag | critical | high | |---|---|---:|---:| | act-runner | 1.2.2 | 40 | 123 | | agent-runner | 1.0.3 | 43 | 105 | | ci-runner | 1.2.3 | 15 | 106 | | **cve-gate** | **0.3.4** | **0** | **0** (1 VEX-suppressed) | | helm-deploy | 1.2.2 | 21 | 105 | | **mkdocs-runner** | **1.0.2** | **125** | **474** | Two conclusions already: 1. **The techdocs chain, not ci-runner, is the estate's worst surface** — 125/474 against ci-runner's 15/106. Its parents sat on unwatched alpine3.20/Java-11 digests (#115 makes them Renovate-visible). 2. **These are stale-tag numbers.** The estate runs artifacts built against bases that have long moved on. Budgets should be set from the FRESH numbers the pin-train releases (#107–#116) produce, not from these. On main this becomes `workflow_dispatch`-able: re-measure the whole estate any time without touching the release path. cve-budgets.yaml says budgets are measured by the pipeline — this is the instrument. Generated with [Claude Code](https://claude.com/claude-code)

ryangr0 added 1 commit

2026-08-08 06:41:59 +00:00

diag: measure every image's CVE budget in one read-only run

Measure CVE budgets (diagnostic, read-only) / Scan every Harbor image against its budget (push) Has been cancelled

Details

e0b844ebac

One run, every ops/docker image, the same cve-gate binary the release path
uses, against the digest each image's highest semver tag resolves to in Harbor
today. Builds nothing, releases nothing, always exits green.

cve-budgets.yaml says budgets are measured by the pipeline, not negotiated in
the abstract. Fourteen images are unmeasured; measuring them by releasing each
one is fourteen releases that can each fail for reasons that have nothing to
do with CVEs. This gets the same numbers without touching the release path,
and tells us which images are hopeless BEFORE spending a migration PR on them.

Tag discovery uses the registry v2 API, not Harbor's REST routes: a pull-only
robot is guaranteed tags/list and manifest HEAD.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ryangr0 added 1 commit

2026-08-08 07:20:58 +00:00

diag: finish the four images run 272's deadline cut off

Measure CVE budgets (diagnostic, read-only) / Scan every Harbor image against its budget (push) Successful in 16m2s

Details

2a535f4de4

Run 272 was killed at ~25 minutes ('context deadline exceeded'), 14 of 18
images measured. timeout-minutes: 120 on the job, an ONLY filter so this
push scans just the remainder (tauri-ci-runner, techdocs-builder,
techdocs-runner, vikunja-mcp), and the filter doubles as a dispatch input
for partial re-measurement on main.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ryangr0 added 1 commit

2026-08-08 07:38:31 +00:00

diag: reset the filter default — dispatch and pushes measure everything again

Measure CVE budgets (diagnostic, read-only) / Scan every Harbor image against its budget (push) Successful in 11m16s

Details

328a491d83

The four-image filter existed to finish run 272's remainder; run 287 did.
This push doubles as the first complete single-run measurement under the
120-minute deadline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ryangr0 merged commit 905f85fcda into main

2026-08-08 12:27:11 +00:00

ryangr0 referenced this pull request from a commit

2026-08-08 12:27:12 +00:00

Merge pull request 'feat(ci): dispatchable read-only CVE measurement across every image' (#118) from diag/measure-cve-budgets into main

Rows
Columns

feat(ci): dispatchable read-only CVE measurement across every image #118