From 3a5e2f9378dc5c6cbde80b72dacbb1260d24ffc4 Mon Sep 17 00:00:00 2001 From: "JJediny (merge automation)" Date: Sat, 10 Oct 2026 20:49:45 -0400 Subject: [PATCH] fix(ci): scan floating clamav tags as the #111 drift monitor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The clamav matrix entries were pinned to the deployed digests in 507c288, which froze the weekly scan output: when ClamAV ships a rebuild clearing pcre2 CVE-2026-103111, a digest-pinned matrix job cannot report the change. Floating the matrix refs restores the re-pin signal while compose continues to run the pinned digests (the actual security boundary, guarded by test_compose_clamav_and_scanner_digest_pinned). Same doctrine already applied to grype (floating :latest monitor + pinned :debug deployment scan) — this makes clamav consistent. Verified: workflow YAML parses; image-security test files green. NOTE: not exercised against GH Actions runner; weekly/push scans will show the clamav jobs reporting 1 HIGH (pcre2) until upstream rebuilds, then 0 — that transition is the feature. --- .github/workflows/container-image-scan.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/container-image-scan.yml b/.github/workflows/container-image-scan.yml index df0d4c0..fdf8b59 100644 --- a/.github/workflows/container-image-scan.yml +++ b/.github/workflows/container-image-scan.yml @@ -37,10 +37,15 @@ jobs: image: 'nvcr.io/nvidia/k8s/dcgm-exporter:latest' - name: otel-collector-contrib image: 'otel/opentelemetry-collector-contrib@sha256:fd328de2552466ad78385e1b1289c3f2402b1c45f265b252aab1955b42845ac1' + # Drift monitor, not the deployment ref: compose runs these images at + # their pinned digests (guarded by tests/test_container_security_scan.py). + # Scanning the floating tags here keeps the weekly CI able to detect an + # upstream rebuild clearing pcre2 CVE-2026-103111 (#111) — pinning the + # matrix to the frozen digest would mute that re-pin signal. - name: clamav - image: 'clamav/clamav:latest@sha256:7659dcb0db47941d3cf8336af84bbb63c7e70b76fc00601774358412b42ed186' + image: 'clamav/clamav:latest' - name: clamav-base - image: 'clamav/clamav:latest_base@sha256:4bd758114dbe0964edf6742cd8ddd98ed73eb8fcd70ce8bb4f53b19a79f07fe1' + image: 'clamav/clamav:latest_base' - name: rsigma image: 'ghcr.io/timescale/rsigma:0.19.0' - name: goflow2