Repository navigation
fix: allow container-size-diff bootstrap without a baseline manifest - #1577
Open
Ron (rjaegers) with Copilot wants to merge 4 commits into
Open
Ron (rjaegers) with Copilot wants to merge 4 commits into
Ron (rjaegers) with Copilot wants to merge 4 commits into
Conversation
Co-authored-by: rjaegers <45816308+rjaegers@users.noreply.github.com>
Co-authored-by: rjaegers <45816308+rjaegers@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix container-size-diff for missing baseline images
fix: allow container-size-diff bootstrap without a baseline manifest
Nov 13, 2026
Ron (rjaegers)
approved these changes
Nov 13, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Missing implicit :latest normalization prevents bootstrap reports for untagged baselines, while unrecognized SchemaV2Manifest.layers causes valid Docker images to fail validation.
2 open issues
What changed in this PR
This PR addresses first-image bootstrap failures in the reusable build pipeline by allowing container-size-diff to report current sizes when the baseline manifest is confirmed missing.
Changes:
- Adds bootstrap reporting without inventing previous sizes or deltas.
- Adds layer-size validation and regression cases for missing baselines and fatal failures.
- Documents bootstrap behavior and adoption through a pinned actions release.
| File | Description |
|---|---|
docs/reusable-build-system.md |
Explains first-build behavior and release adoption. |
.github/actions/container-size-diff/test/container-size-diff.test.js |
Adds bootstrap, diagnostic, and validation regression cases. |
.github/actions/container-size-diff/README.md |
Documents bootstrap reports and failure boundaries. |
.github/actions/container-size-diff/container-size-diff.js |
Adds missing-baseline handling, current-size reporting, and layer validation. |
Review effort: Balanced
| if (parts[0] === "docker.io" && parts.length === 2) { | ||
| parts.splice(1, 0, "library"); | ||
| } | ||
| return parts.join("/"); |
|
|
||
| const layers = | ||
| _.get(manifest, "OCIManifest.layers") || _.get(manifest, "layers", []); | ||
| _.get(manifest, "OCIManifest.layers") || _.get(manifest, "layers"); |
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 34 | 0 | 0 | 0.36s | ||
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.58s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.46s | ||
| ✅ JSON | prettier | 55 | 13 | 0 | 0 | 1.12s | |
| ✅ JSON | v8r | 55 | 0 | 0 | 20.41s | ||
| markdownlint | 31 | 0 | 1 | 0 | 1.63s | ||
| ✅ MARKDOWN | markdown-table-formatter | 31 | 0 | 0 | 0 | 0.26s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 1.21s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 22.28s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.02s | ||
| ✅ REPOSITORY | grype | yes | no | no | 100.21s | ||
| osv-scanner | yes | 1 | 4 | 2.25s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.49s | ||
| ✅ REPOSITORY | syft | yes | no | no | 7.04s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 10.87s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.67s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.46s | ||
| lychee | 165 | 2 | 0 | 116.28s | |||
| ✅ YAML | prettier | 56 | 0 | 0 | 0 | 1.16s | |
| ✅ YAML | v8r | 56 | 0 | 0 | 15.84s | ||
| ✅ YAML | yamllint | 56 | 0 | 0 | 1.6s |
Detailed Issues
⚠️ SPELL / lychee - 2 errors
📝 Summary
---------------------
🔍 Total..........301
🔗 Unique.........205
✅ Successful.....294
⏳ Timeouts.........0
🔀 Redirected......32
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2
Errors in docs/requirements/security.feature
[ERROR] https://slsa.dev/spec/v1.0/threats (at 42:44) | Connection failed. Check network connectivity and firewall settings
Errors in docs/reusable-build-system.md
[404] https://docs.github.com/en/repositories/releasing-projects-on-github/immutable-releases (at 199:168) | Rejected status code: 404 Not Found
Hint: Followed 32 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 1 error
.github/actions/generate-release-summary/README.md:67:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
⚠️ REPOSITORY / osv-scanner - 1 error
warning: Package 'minimatch@10.2.6' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'minimatch@10.2.4' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: 4 warnings emitted
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v10.2.0 (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@10.2.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First PR builds of new images fail size analysis when no
:edgebaseline exists, blocking subsequent supply-chain and integration gates. This change treats confirmed baseline absence as a bootstrap condition without suppressing other failures.actions/vX.Y.Zrelease. No workflow oredgetagging changes.