Repository navigation
Conversation
… workflows The image scan cannot see dependencies without Maven metadata inside the fat jar (e.g. BouncyCastle, micrometer, reactor-netty), so CVEs only the PR fs scan catches never reach the daily alarm or the release gate. - Daily scan: run an fs scan before the build for Maven image callers; alert and fail if either scan fails. Drop the unused uid2-shared-actions checkout so the fs scan does not pick it up. - Java release: run the fs scan as a separate job that buildImage needs, so it fails before any version commit and keeps its output out of that workspace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ticket: UID2-XXXX
Why
Java services' daily scan and release gate only run an
imagescan, while build-and-test runs anfsscan. The image scan can't see dependencies that lackMETA-INF/maven/**/pom.propertiesonce they're unpacked into the fat jar (BouncyCastle, micrometer, reactor-netty, okhttp, kotlin-stdlib, AmazonCorrettoCryptoProvider…), so CVEs in them only surface on PRs. That's why vuln-fix PRs keep failing on CVEs the daily scan never reported (e.g. uid2-admin bcprov CVE-2026-8763 / CVE-2026-13506).Changes
shared-vulnerability-scan-failure-notify.yaml: for Maven image callers (scan_type: image, nodockerfile), run an fs scan before the build, sotarget/doesn't exist yet. Slack notify and the failure step fire if either scan fails. Removed theuid2-shared-actionscheckout, which nothing used, so the fs scan doesn't scan it.shared-publish-java-to-docker-versioned.yaml: newfsScanjob thatbuildImageneeds. A finding fails the release before any version commit, and the scan's files stay out of the workspacecommit_pr_and_mergeinspects. It doesn't upload SARIF; build-and-test already publishes fs results frommain.No new inputs. The fs scan is always on for these callers.
Expected impact once
v3movesNew HIGH/CRITICAL findings as of today: uid2-admin (bcprov 1.84) and uid2-operator (urllib3 in
scripts/aws/requirements.txt). Both repos' build-and-test runs onmainare already red on these. The other repos (core, optout, validator, snowflake) have nothing new.Before releasing
v3Draft until the vuln-scan harness dedupes fs and image findings of the same CVE in the same repo. Otherwise each duplicate gets triaged twice.
🤖 Generated with Claude Code