Repository navigation
ci: run image scans daily instead of on every push - #3496
Open
timflannagan wants to merge 1 commit into
Open
timflannagan wants to merge 1 commit into
timflannagan wants to merge 1 commit into
Conversation
The image scan workflow rebuilt and scanned all six runtime images on every push to main and release branches. Scan findings depend on the vulnerability database and upstream base images, not on the commit being scanned, so push-triggered runs mostly repeated the previous result. When a new fixable CVE was published, every later merge reported a failure it did not cause and could not fix. We now scan daily on the default branch and keep workflow_dispatch for on-demand runs. This also corrects the schedule comment, since the old cron ran on Sunday rather than Monday. Signed-off-by: timflannagan <timflannagan@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The image scan workflow rebuilds and scans all six runtime images on every
push to
mainandrelease/**. Scan findings depend on the vulnerabilitydatabase and upstream base images, not on the commit being scanned, so a
push-triggered run mostly repeats the previous result. When a new fixable
CVE is published, every subsequent merge reports a failure that the merge
did not cause and cannot fix. Between Oct 26 and Oct 30, nearly every push
run on
mainfailed on the sameuiimage finding until a dependency fixlanded. That makes the post-merge signal noisy and non-actionable, and the
paths-ignorefilter on markdown files only trims a small part of the cost.This change drops the
pushtrigger and runs the scan daily onmaininstead, keeping
workflow_dispatchfor on-demand runs, such as confirming aCVE fix after it merges. It also fixes the schedule comment:
0 0 * * 0runs on Sunday, not Monday.
Additional Notes
A scheduled failure is easier to ignore than a red check on a merge commit,
so this trades visibility for signal quality. In practice, the post-merge
failures were already being ignored because they could not be attributed to a
change. A daily run gives one clear signal per day that can be routed to an
owner or alert instead of being spread across unrelated merges.
release/**branches lose per-push scanning because scheduled workflows runonly on the default branch. Release coverage is better handled by scanning
published images at release time, which can follow separately.