From 3adcd5a709d9406167dc07324f2eb618d0c505fc Mon Sep 17 00:00:00 2001
From: Nick Josevski <nick.josevski@octopus.com>
Date: Tue, 18 Aug 2026 12:54:31 +1000
Subject: [PATCH 1/5] Let the CVE scan run unattended and report only what
 changed

The script reproduced a customer scan on demand, but only helped someone who thought
to run it. Two independent things change the answer: a new build bundling a new
runtime, and a CVE being published against an artifact that has not moved. The second
changes nothing in this repo, so only a schedule catches it.

Running it nightly is useless without state - the same finding every morning is an
alert everyone mutes by week two. So the script now takes a previous result, compares
against it, and exits 3 only when the set actually differs.

Scans several versions in one run, because customers run old versions and the tips of
the supported release branches are what show up in reports, not main.

The two scanners run as containers by default so a local run needs no install. Inside
an Octopus execution container the step is already in a container, so docker-in-docker
is unavailable and the binaries are used from PATH instead.

Runtime drift against Microsoft's releases index is folded into the stored state rather
than reported standalone. A runtime that permanently trails would otherwise fire an
identical alert every night.

Colour is now emitted only to a real terminal; Octopus captures stdout into a task log
where escape codes show up verbatim.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/scan-calamari-cves/README.md          |  52 +++-
 .../__pycache__/compare.cpython-314.pyc       | Bin 0 -> 8834 bytes
 .../__pycache__/summarise.cpython-314.pyc     | Bin 0 -> 6374 bytes
 scripts/scan-calamari-cves/compare.py         | 159 +++++++++++
 scripts/scan-calamari-cves/scan.sh            | 267 ++++++++++++------
 scripts/scan-calamari-cves/summarise.py       |  99 +++++++
 6 files changed, 493 insertions(+), 84 deletions(-)
 create mode 100644 scripts/scan-calamari-cves/__pycache__/compare.cpython-314.pyc
 create mode 100644 scripts/scan-calamari-cves/__pycache__/summarise.cpython-314.pyc
 create mode 100755 scripts/scan-calamari-cves/compare.py
 create mode 100755 scripts/scan-calamari-cves/summarise.py

diff --git a/scripts/scan-calamari-cves/README.md b/scripts/scan-calamari-cves/README.md
index c7b9d13a9..4f50e5ea5 100644
--- a/scripts/scan-calamari-cves/README.md
+++ b/scripts/scan-calamari-cves/README.md
@@ -3,11 +3,17 @@
 Run `./scan.sh`. Takes about ten minutes, most of it downloading a ~270 MB package.
 
 ```bash
-./scan.sh                # latest main-branch CI build
-./scan.sh 2026.3.508     # a specific published version
-./scan.sh --local        # publish from your working tree and scan that
+./scan.sh                              # latest main-branch CI build
+./scan.sh 2026.3.508                   # a specific published version
+./scan.sh 2025.3.417 2026.3.508        # several, e.g. the supported release tips
+./scan.sh --local                      # publish from your working tree and scan that
+./scan.sh --previous-state=old.json 2026.3.508   # only tell me what changed
 ```
 
+`--previous-state` makes the script exit **3** when the reported CVE set differs from that
+file, so a scheduler can treat "the answer changed" as the actionable event. Without it the
+script always exits 0.
+
 ## Why this rather than `dotnet list package --vulnerable`
 
 **They answer different questions, and the local one over-reports.**
@@ -76,3 +82,43 @@ regression test for it passes on the *vulnerable* version, which is the proof.
 - Vulnerability databases move daily. `CVE-2026-44788` was absent from the NuGet audit
   source at 10:45 and present by 15:00 on the same day. Re-run rather than cite an old
   result.
+
+## Running it on a schedule
+
+The script only helps someone who thinks to run it, and two independent things change the
+answer:
+
+1. **The artifact changes** — a new build bundles a new .NET runtime.
+2. **The world changes** — a CVE is published against an artifact that has not moved.
+   Nothing in this repo changes. Only a schedule catches this, and it is the one that bites
+   (see the `CVE-2026-44788` note under Caveats).
+
+The `Scan Calamari for CVEs` runbook in the `calamari-cve-scanning` Octopus project runs
+this script daily and posts to Slack **only when the set changes**. It invokes the script
+straight from this repo, so there is one implementation and the runbook tracks `main`.
+
+`--octopus` is what it passes: read the previous state from the `Calamari.CveScan.State`
+variable, write the new state, `HasNewFindings` and `SlackSummary` back as output variables,
+and attach the raw scanner JSON as run artifacts.
+
+### Scanners in and out of containers
+
+By default the two scanners run as docker containers, so a local run needs no install step.
+Inside an Octopus execution container the step is *already* in a container, so
+docker-in-docker is unavailable — `--runner=native` (auto-detected) uses `trivy` and `grype`
+from `PATH` instead, installing them if missing.
+
+Those installs are **unpinned**, which is weaker than it should be for a scheduled job: a
+scanner upgrade and a genuine new CVE look identical in the diff. Set `TRIVY_VERSION` /
+`GRYPE_VERSION` to pin, or bake both into a pinned execution container image.
+
+### Why runtime drift is part of the state
+
+The comparison also flags a bundled runtime that trails the current patch, or has fallen out
+of support, using Microsoft's published releases index. That signal matters on its own —
+per the EOL trap below, a clean runtime scan on an old artifact usually means nobody is
+publishing advisories any more, not that it is safe.
+
+It is folded into the stored state rather than reported every run. A runtime that
+permanently trails would otherwise fire an identical alert every night, which is how an
+alert becomes something everyone mutes.
diff --git a/scripts/scan-calamari-cves/__pycache__/compare.cpython-314.pyc b/scripts/scan-calamari-cves/__pycache__/compare.cpython-314.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..cbdd9abfe2412c21a8b8a495fcc398bbf32ab461
GIT binary patch
literal 8834
zcmbVRdu$s=dY>hiZ&G}SdQhUIwI$o4EKv{3FUgPCvLxHG6?sk3HlmZdB3BY)iez?|
zl0`RH;R>{L(u3{vuA-3umVsQO9PSYHkD@Nn;+&>MbG^eI9m*E7QDLJO;1Hk%{3`Bn
z?H~PS$z4%0<p3Q)!`<1LZ@&5Fo8R}C-6a+yg5v)9pT5~wfzWU8i(FLshv#p?!#tvq
zfJPBboFW85`c(-k=~pd~@T)qdIjI%2b%<6AI-0CNf}YkuZJ@PK8)+TXrtg?({eg=J
z1z}b<`i^NE>da39<A{3c-(z6DBoI0_Imxk;jKEScmTQ?|IX)DPP<(uPn&Cn$-%JIf
z(=mo)DQ1!hMR<XVaqLVe8s{lqfKkm9$Ht<ZKn13l$Rx{qjm91(9A<;m_#DLtn2493
zqL>MR<tP@2&r$LWQw&dyvn)&nog!?|OVKP7<c)`Bquk|Sh&$4HD9ntr;Uld%Ugo@S
z^1xUu3^T9yk(rS`HdC`)NMH+TY#7@pOtDmioy~FXp_oXpfD|8Q0++qQ6@kk2iwdEM
zP=FCY9LDizaL&^#4Ty1}h`>{r)Kq+$iBQ4N#00Fm_euza5Dl`_9%`CpB0RMn_ko95
zSbI)7!R=HFjAR5Vl%v1|FnMM?%wp+81ZpD6QH+rfOtHaunB}~bM7AwYF%lJ~LXk;o
zIy%D!n<+j@F;pZpIVFVWC@v176qq@ldMh4c1+Q_?Lx|)MBTOZHQ-ToVyINa0X4X3y
z5~kwgah~M@(TD(ZdSQcGgHa*E3ax=C$F@$xKDTmgm}Pjj1*T+q`HgQ0MS|=VN!S6<
z9i?dDNe%zcMX2VH7sZGX<+~qs=AVafpG}2UzS>Y<EkZF>HS!ZfnoZr{bwnq(`BgGS
z`L_-YPzV`NEgCT?y$JbhJ)+QvUT)W-U^zY(b;wtAo>7IPI#h!O&L9**-Rc??B0!>q
z*P|8HyugVXJ{ArMqLzup*ho-RgIb72KNF6#y&M;X??OBlW<6?=m=QH_f&^aF1g7GV
z%RH9CPKpwZ`J?5H&50K1!Lwue)4^Gxixd9&H=vqFS#!yJ@0#6t<J@1CFSu{IQ-O!}
z?MclOmD=FWn(f!mTs!kYX=?cWs)y!=ryAs_e_=#s`;D@952eY9-@nixTh$9hD1B4*
z>#sji!}}k2JJ7#Vb<C*x)aX9er1{iCKplWar5NA|I3}N)0jTCtH5ySq4av}@v>;S;
z=dgZAWz<O%`}3o^i7_IsimS&IaEcY|(vSq0^0?gZHsnV`mW^%rO$Il4zheZg!hfB4
zeXB#QpjQ`(A-vj6g;vX>x`|!+Z<8<%>xUPCPBNgAYM;93SW+GvBe&?GQF>^6<VN}f
ztqA!vo7xT{L~DH-TDJu~y-bfbY|+Cg_h?mLYS;-Y8i4J@C&Q=0=U_KdW`uokqmT+~
zd7bok<_9@FhtpCbiwRB(>>idzD~hXXQ2qL8FeR3+VqlA~;Vvo+#sI7Xz>pA{X5XeJ
zxac%>HWc8Zd~`x+rU2NkzD<QDsCa~985jnj2e5e@4`L?(_XG;Vdz_0!dDcrElk7qc
zEU|%z0%<&q>JJGg<Kq-R6^)03fOw&BST;c+fj9Q}d#MRPDS%0y;sE^sd;xJI)C3a>
zdyQ~{b(p_sTo_E0<UuYEYYA(9F|rj*l;jrGl3$dl&Ap3iHX2Uop=t@jszn_ik6{~_
zu;d?FVqo1^k3rPNxo|i%F6ub;tvIYy)ImcO@Iox1d(ZS9JKuYL?9||i-isoMt(&L`
zN5KY)BrG*38hWn;*cdhtqI!}Q0CxyZR0pF0Q4Q>i8o+LDPSoX@<{YqNJU(cYR5-kY
zVtxf<F-8EJ!gKY|2q262EL8L8iJ8<m)-0vhN3V^pTI%mx>OUO3dpvEaU$q=vu^heE
zzUC-jXnL<Hb?&zRmjC^W8OP3K&+pWz<Tc`n9+@ojJz2YRq2gvm+U3dEn^x^@X?xq!
z_!suJq$caASn%BRq}?qUhc~Iq+RGPQH(lxK-5GmxQv1l{xVC>`=H^V+-LN>Z#4Zp2
z-KD>|bT^UNdphghu^9ho?#|qDU1rxYz$teRk?eW*%u@q$v_CN;vvvOT?<z14z~%pZ
zZE^y%X&hOr{T%~z);Rvadtq_kYw6j8KH1SjX+Cx8;qf!d)YE48Y&VIY+tj$;V>zK#
z|FepKI#7sY3gWdvt7Oeoen5g=qR))6fF_3W_6(*`%19n-5b`UCQVa`e#VXON<|<{l
zVsm07SU=r*yZq!|#~O`)GitmJ))8|pmG$`x+BCGf*lY(tYl7SH`Sz=Z6w4`7!fP=j
zn)H)U!>k)=K%2HhE2B*v@@tCmP3z<yFXJn%e-)a?w0^CERT3f(d<Gn8Y4bsle-5Ju
zehC=5HRlGu){HvTTX3czr94XzY>OMwCRnMlP+CAkb(Wy@&Fg|u_Nxx`VgSrFMp!=}
ztjEIqF|gMcW+tiecqE8j;XHm|pAURLfdeRlN0ti2ISzY$(&>~S5<A*(xT)v_xZo0~
z07m+zz+IeX1aP8x3VUGK;ec`A^+7)-GDiXGNs!5gCt9#u2Ob<u3!VuTU^wi?Q-F<B
zbT(qlvy$^=6?g_5jmCID-|=vWmt0IHI1}Qd(opP^0#7Z`iIzN1vJ=l!Ek<xca~?eK
zHW|%1pBTy6E8yG$hmsS_fiDfOc>x4j@IGf)>C<!+@Sl(Ku}}bj&TBkI1;Fu)$Rf*G
z0U!rWQNVj}qa;e$fyOogLJ^QefQ9wpCZ3r9qr#D}PhErG;4?ia;bOv>lX}kUmc^dX
z=Oj-xiiC&5?v{uWB&Nfa!b?KiO!dBgh5{E(iyieDRy1MX7@TGXrWDm-f%oVDxuc;7
zhy7I!qc2y3E9}2<_!MJEhX4Tj>18btb$K)vHIjENsyKmzGl)bo6q$&Evxuz+k4NtW
zHxWt>%Pn~VW6~&Y4}8b}{C`0OP;NsOD>#WI<w;f6QMS-{v+;vHDenFKw-4Vsyi}U0
zZdn?CP~Dz!bO07x%dcO(b~Uv>W35k;kF2F%nw@K=%9JBxa)0pll5e^3r=yv=Lo233
zdFL{9Jk^=5+q2xieDLncd%n*b|7A3N!k6|9r(OOP^M$OvY@zaIWeRLS!>YY0ZEspq
zt=ih}+uAd>JxR?YlkM8x8^h`C#~+p*FQAwb7JC=>r(L^0cmBHa=ap&t!msQ8t!}ye
zE_rwOA5F_|-*4?rkN(jE7qe;}e_D#H6;GVt)y|)J4hu#BT*(FdiWq;NN8o85t;ZfC
zSO=ssgq31b86^r&xr|fbg}!nWy<t?0z`muQ08eoSTZaqk<^miAj4yZtY$uChr0l=S
zIF!e>CO~y1YT3dcCSQf1%8CHF0Ryp8ZYs3ei#qeG1)MM5hg|Q|s=81w`IJ|3hzHTY
zw{ZxTqfiE~;<t!}Q0z-gJEC~+e(ebMcBCS6zfpFuC)yE6wB-Bbe`7jY7t=#@Y5<$z
zlE1G1%KHF&S&h&v$c5_~fu~&Y88_NLpH7||zUU>Xz}c5PZP12ZRo^e9$U#+1?mopw
zh#7sxiJWzVnS9!B>1`Up_#zdUl`N{iW}j)|Q^}GUV|t%qs7@ZS{!5#D*s_~D6h0st
zF5c5Zmke!NA1Oa=mWHfrMfT8&?Wg>G%Xw@g^$KmX+#7hbcc^`4d3STZ3hgM))5wmO
zDae!xZ8zBR(!zJS5AX&%StwJ`1kj?GWeeFjeU^=D8vw1s8UQ{4XivdjnTqWzt@v~=
zOAXE(xDmL-O4iqP=~vAKak0|FTF~P^i}tXM$Rb3(;=CxD@Je3nK6?SBO(#O;=fEUz
z?I`G1d`2afedUa$FYn2)Gp_PNG};F-PR!|Z`brBtLNlBq=b&o9mfML~8T7Eqi=TAk
zbK$co?_l-e-J!h0Xm~GE-oa|P@os(tarw8MCewz~q|6y?kZ2Y^U1h~J*=LnyxlzB?
zIe#V9@-3*^wxFu4KX~pHyl#aAcA4tS`$$*739j6Nn=Q1bIF%0NtiUNP`+uKH)xfWE
zdNJb3oh~?~>((AD?&dPovbkkF-y~~EP{ME81-Mcr%L2Guk6t9LTAz`wF6gCKsK891
zdj?n=;8?7@puf#mKGga$AGC=sm2FUQJR1Pw7>~}H3aGgYW`_%f4c58+<yi_We8<aQ
zw?X_hs-lf_&3^2GLD@jP_S>lY49fb!rbF~qSJc`VWU3%zN`9^@+&kHL=a`Uc;B8&H
z5FfkIsDg5E5n`x^i<Wg-_?<!{fC#w)nJ*n4BV`Y@HK><7(<Ent<B&Crt76U&@@)GC
z<8&8?ZO`Cf!d!Ue0EwSmK1?J7Gc2F5Y`CvTsII=<Cu)LRXhInDi9}Pv(*zd;6Cn=A
zM3D7rrXXhoiL!i5hC``w2o1sz-6c#A7UXDmQ3+Kul`ux45f&~GAm&V{C@Nutn+Zsd
zMFIj24;y(;Le)iaSl9`>GM17i2MRih8tlCQ4|)p1xCq-ti6kZn@leYVD$!`HexrT5
zCwCPDVOY_-pz1f;rW2I$TY4p4qabwKbd4lMyWtQ7t@wfjM__QBp)4Na*9~hwAW^`H
zuSsB(XQtT=Yo&M=5{^>yrU=}l616yhhE%-)qFZ6?GCRj749eAyNEj2w!D#-v#_Or(
zFg8HGe-4sz3^zF=YS}9wRi4A%BZt#Bq5&uC#sv0?AccOSF~sA0GATqPgQ0-Hfz3fu
z=1tVV_0%*kg>FEU6{HZ6+bzuzhOD3#GsOl)61E&Ne9~PLGzvkS@Y9BP$N@mc4{qGx
zu8I|n(sh?KHE2<MItEMvdxEDz)a7r{aLN)c(ctPqx~+p~6u*ijM4(e5!HarXAvv5g
z%Ow*hfdLKHF<w+hqO+oQoP`tsE9$WdL-09^H3QO~Ch0x@QNsj-Fb;T=E~h{$!dU*3
z5gv1U6%@^qzR6z*NOI;H;8qSV8s@}KJC1palw250;uxHpgl?zcpWgu%dLFHnIDW8a
z;lRxUsbfFv&Xm;6_pe!O*DqeXcw_wgBlCTa@%_nH_6o>KTFbxxCyTWYtgT5hYqDPN
zzSe#H@LwEWvpE-x?-^5_w~yR9l7SqhtvPuNCnDeaD1Iltbm^`tv#a~A|K7QO9sYFq
z^L^>_!<k-xy81%0H<y>Jd}7vU%GXLO7P{W+O3g0SJ*YddTHABKwkK2DyIOlTU3>O(
zXQp&8sb90YQjH&;Shae-uzIo;uH?xVdStE1l+@1mKQ1Yq@0ad+o)}Sud*SlU%YQX}
z&6w1zRWvM~Uvm9ubooN2;&4)(?0?t%RE;VcUTBe{5>{1GdOdV4l+pm1q&jOVd8Zpf
z`mEh0T^6wrmM67qrR6vH)V?2H&6L(B^^Z;VcaA*KqKfJy%qZO;rP@=&ss42RnY8Qd
zig{3O?Oqh5WNhj3rN6Ds?0Ri=*HC)b(7iM1o#)andc}NR?%44`V6pN2>C{-d`B2(*
z_|fsxsS}HxA051N@F)J|lbM#onffCS-AB?x^na^~Djxx9Tgx!<xUxFcf7_fg-ypNL
zvIX-^bGoi=*}1Gu*X)02I{>S6?f4I~^Xqa~YUk~yTTP4pOjYx0RY$t2V_B6c-;*@0
z*~)KRc~H@kv3WsKj>=T^16OOt(U#P$IV)4;x2tYdEuPA_ysNIxw5xM@d&appX~>q<
ze%P?cFCF~RcQf1f-7njhG_F-tr}}Q6zIA$WHsfwxb?;5P_bzv2D)uGKS*m`q|F6v%
zXWt!js(qQb>%QOCyKwHtxjW{hA?@t@t;x2~e>?HXr5|6)mRD_(=wf@yy<*<^$m+~5
zFg2SOX<261{`AfR>6(KpwysCka{2p}CGr!)$A;xynZ~a4uI_Zrp%vTVM^=~o{pwQZ
zCkH=1xO^$I`{?TKQ|aBO?(IuAozB+PFP`}5)SXjHfo0E6BbkQ7s}23>hW>ly>H3q9
z8m~Q#Wo{oJep9)vxU^q@w6{MUAV8^JK$2Ty{0IJLiN8;*9v!-WbZGS`{l!uGzOg%N
z?RWu+_Rim$O4sz3bji?){@f#7$yZKS^28ckJ2s@8x81kgi-DyM5c>m%_o2D<nHrT<
zfwme-(j_NX^rs$c%*pRQ(A2Dwp8KTdCk>x8{kUm)_+EQ@$hXooyh8f3(BbL>P1P#7
z^FF!rXM1Ilt?b%=FT6sY|C-eO`N{8{T-cR7_mJF{dJC%Gzvx#Xa~Zx4D9@Iby{pI9
z0p<VuY>+@@{R9tgIQpmkExuax*^WA>f3e5l>(Ks^&_caZYw@+JSG)w&qJC@)W6ao?
z$0F*+#^A<fY%B-(M}dS`lDpLL=I?a4GTexBdQ))KBN+^?5}I;3KpfLbcrPIqCLIBD
zH8%D!;;_S#gEal2=_tPMKf*<z4Z9P3KUBazK|Cc51o_;F2=iCS_!TPqcU1Y<J~?0V
tOsgX*pE(_b^;uIXVSm<46U6o>Z>kV!P9|2=t}jXbpY_4%A*-Z`{tte8Rek^f

literal 0
HcmV?d00001

diff --git a/scripts/scan-calamari-cves/__pycache__/summarise.cpython-314.pyc b/scripts/scan-calamari-cves/__pycache__/summarise.cpython-314.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..393bf4545e02c08fc98d6c6b8a2d48cf9331a94b
GIT binary patch
literal 6374
zcmdT|eQXoS6`%F`W9>NpiU}c*WJ4gtNpJ`x<s*<QB;*J=XjsCAwjt5R-WY>p`*znM
zaeI|}m8#HFg(*}-YE_vY(j|o!OLvv1dew32Nu^S&b8sN(UQSo3Csp?!N6@MCufAD(
zH%>?odjEB#ot>RG^WN-x^Lz8&G}wwQ2+GIzesFGgF+%^qA8OI%8%rb5NFWADXb>?(
zHz5(qTPNw1Hz|?u)^+QT7$id#V#xJKGBSFoO^g9*iZMcMK4W1_drl+d2Z@`|8FMvi
z$qRrvM2+%zDDEPGP+v?4(~&SwkMV*SjD)v|w7^}U`-I@w1kHv0^vl9Tl&2#xDH@aL
zU|5RK94*F1M>%1_Yq4~2p%Cw<hbL&!$A!J(S>Wa4=_oHK9bus58GGqo0j7(zbe5;j
z#zwjDc7f;o+;E7eC8Y*wmJ32q;zfGDKPa>}sbbEFkuW_H5oljzG|CCQH#$M%bp!$e
zAK)Y&*3lP{xDY+cNxri%9k09I9~7lv*eBJ~9qeI|_6J8sU{xF)ib(sEMTp!ePmct{
z{$Myj3w)I4V0D~Nh=`))do8<YKOYsnIoZJwFE%P_!hbdr;>IE|;00os?oKa#koLty
zDKZK);1dx*Zh&stX&H-!!o0u@2SY(A2<r-hazT^9Fdv#I7zyh4T8?`NS>MY^XMJE5
ztr(z1!n5=`R0*^Z4QQlZb<=1)2vws2JVPlgYRPlzHK~2eZ*@bcV`>nM1}K$oM1J72
z300vA*o-wOh}y^s6eMPd;~s;o$4Ze6p$O*}1-uH`j7>Qt@#B(gK0NN@qY`W-{6kUr
zArUX5R<`EM85FVoWIdiO6amEvkJt)T0zJ}^2KS=9<Wl@c@t<#*l73b{U+$eP_h!p?
zWbMrvs`+1wMeZkvFt}xV$s-cp{}!z<^Yz9ibi1gX`~%TWu23K559-q|{SwxYKrGq@
z9k>Jlftvth19=r84I#U9HEZ?@)hz18rdU-NLRDcKp>c<CSb1LLKwXy*ijpk3=3L!#
z=8nQ#JxdG{jj&#|L<v^ctC?BtMTpg}DT7pH{1>|ZIdsEw=*H*JO)7nt#;FSRL=ZBg
zO4M^X_wILLy?dy5+xB+4PAWumBmJE^kq0jllqMSKpudrho)17HECS@g`7{EC$9cc!
zHIHm!crg}|MA^=+M4n8Y%yU>tn&|G7O}*y>$H5iIj&7ADoAZUTwF`63e|bom6nRM|
z1GwV+en0~0kN9MRvRqj&@_bk}3d#~>Voby)s->X_*zwCY3H#Kcyu%TNP0(2ekN8`t
z66l{rwgtQ6YR#3cljD>21y{+{lUGhnwk){TUE6kf+mt8k+A{B|&$#NRb@yHMlg0(-
z`fKHv%QKs{XPw@8XG_M}lHPpZ*)n->!Rkz&`0>%n!wXi&r6U)QEI6Fk43`bbb6H1q
zs`;(f>#Z5jzHCj~ofGe!`rWC!d$R|Q<%eWS>#`2dbo1@jnbve=w&ClK3}mV83q%&%
zmkh|&`Z<Y88Xnn@)j8Rg(U&g4!qHlILrY)$Pk8$($chrrVmGQ|2|(O$z8d11FxJ+_
zsfM9vF%Gi~YvXZ1bGy$&o{Es?&d?CF#tg%n=-1Hs!ZS3ysxx+J9s+Qi&f#^yjBSq#
ztNA}xm&5R9xLY>m4`aEw@D!YoDGrXu5zZ&cl!|Iu7xc^eFvg%MA1!zcf*ZI9>u^<y
z`H`X|$Yh8QdyK+*+)LwX111rp!bauIiAH!Um{UO)z~Rd>=o)~Iy|nlNR0;ISO3>My
zmjV|9$zaw-&)aG<w%XL8#LJ6Cwl`W6ogWpuCy51X@ukBT4=0<l*3I+Qx{S3hHN4zg
zpS4!ZTWd1bnv@HADeEQbB6YPU$z9_w^HWE&rQ5Qux?45V+--h_Pj}utpRM1w=vtSj
zcU>6;jNkB0SKr<`vo&o7Vz#yoPC3_sFA!mF|J;OZ>z-JU)joOQjr~*ZOi@KfUm;Y$
zkNDuxiXB?`oLc$?IH1IH0tPr)%C(sV!NZq_8H2jQS?WF!9A1PG$PkVA+|3u|?9-5-
z_AZ~d>Y3?};WHEPr|qm~$MzQRRjFzq1Gs1KX*qxc0;TlY)YkI58lq=FBaS&%6_rm*
zKCA*%8`QN0l=Hl2C+v1zZ^^2O@W~o_@kU)$1~p`;8Up<E<?(~Juu=x_7FG(YMFZ;i
zsBQpnY^4lfLn{R|OcrWb9j(4Ez#j;Kfhu+UikbT7&b&BKt<Gc&EV3fTxKs0gRfsid
zS^<QD#f*bU$u*RSs$j0>N2<`Vv4VbzH3CobK#eMe)kZ?UWvAxjs?dO@CDz0gtw)S?
zciuW+?QVoFzz!E~3V)5-3i%Ig)i_&JoiN44h_Mw=iZqIS6~(Gi9IGhB8pR0|7i+Vk
zotgx&ZBO2|%la!>Lx1K~`lDVzf5!^{kEK9Q?gIUp)pdP|{>;p}Rr;ere|klKAFkkT
z$?1wMVie7=Rz}eSYlpw3R7vo+n^*5-*5p8^9H*QyatDg(x*(Yt(?uOoXVk$u&+B?1
z2*MFxj8uBeFFv->q}mg_Mm}DTx|mWHG3!|!Q^vZO4NN&}WHuJ)MB7tMI%X44sTEXB
zV@<jyL$m}CRZ)nGUe!d)g3&;o`q5jjwwB-3h%Fh^F_r56RM!dlc2x~%qbmR3!4+)}
z{TcqBxK)USrQj$pdZlqG?r5s}_Kxj)&)~{?rrxt9Zc#!<B^QlbloKu2rYyNUy-p@P
z@nV{;3rF&qx+kuq={UWd5i4me4FR*7y^1tM+Ho`8*?qFF`*=s+iZ~AT1;T!A>03}0
zo*`|-3EffTSCEhM8wRb1tjeKfPhH?CkL!8>m)O>=#u`XTSC3J31MxobjMQCN>K>>z
zL;jRNeW=R;UcDgJTaGuzQ3CEjdR#eKI8ALOgM@(BK0^rDgflu>=iMO_<05t&wfUI9
zyg$H)`SGaGE_+6~VA#7q6!CE(u^k%R=&+x|4YfxddIT7V*ad$EtIC}4&kp-CX9nk(
zQyI2@o;jUiPG^UGPnWRp*UQQwQHHc277g*xAcR~7oJ#{JRft@=ws1uffD7b&c=#`e
zXBAo56aEhmXI}B&TmGJV#jhOxkY<zT`3YIKSCk1_CU@=>WpdXZsG3{EIF-we_R(?5
zlDo>Oi(9pA0bAf13;aLZU1$cq32;uMLW>Knxc6&N^<oM>a1|?d_RpSTGrcE1IC;<c
zC-yFzJ;gp1cH^;l0}A`_V2saN#d5-a+<5>hg-gyt@5SDY%_@Ado&E2{GB5StS^l1T
zsb8@WT$OOcd`LFsVJ_=^W4s6(1Sf<74IE`ky{(cB3clm{+mZ<d=wM<a+*9#k>A0s9
zBH;;9)^kE&EO+^0<j3KvOBAr1lr3TuE}KGd#U#o)ftQUU&k4S>vH`;9U{p48(I_AG
zV=0jse2Q>c#rt!yHcm*D8yNvd$+97e@9PBY_7pJ5xyw1_mPY`9!w7$DG%9-BLKprr
z!<`-PlOh7d_^LmXi`5o{;2|DvePCgN2M;$%L%F=!C=Dr@vnil<1acjaZI8($s7fXw
z<Co1^#xEO`j9(@pS&)e#neYi1G_omwVJL!oLOAhWU2+K2W84YnVN44=;%nd=5@>OK
z`L*%O<0;~&-?`CwtK@dsOj)}6*Bi52S||7Z-R?{rS#VdRY!BSt#IXgFd)~Bh*0gcn
zRB_)_vEZ(rcQ?$s8?x^0^X@&f?mZ9P`zAXV9j<HUpO`b{+oz@5@tOF|?`9qQCl7vN
zcU*jR!BKY2e%YQP-ZEV`O%rcg9y%HzykFP$ghGzetG=l^$OY_M5=TBQ-EyOE+LI1F
zs6Uk5+L0~o{Qfr}BU!WeQ@wezJIN>erw(Q;m2>*4Pl}w$K+1VFv`7_CMjlX=pHjt1
zU2=EQliAqzZpU5Y?|beXxM$ATm^td?VpD5+WcHAMzKNf;HcWOTeJOqsE)ou16{mJx
z8Bghwqp9W_C#Or^JU#789Zy%k({YD<`^cS>>Gr$M4|d(1_+xtpoZ%rh!wzPK{Fy;M
z;~IHr4ZxMbjuGOC5g9Bmy1J?Tx5(+Pn?<SD(%l(b`yBPs;^w;P(%IJj`OT+it(ACj
z%F>eJ)XwDDDK15(I;JM3iRqeY-}Hubb-E+nnsM!YXx#_WYraW5u_CMMIy>iTyv|OQ
zO*y9yrid%e*V+57#`kOIn!4YwO`lD3cbs=lyiL4cd%vmsfvY=PbTrZV$cW62<hljQ
zncTBL*^>GN%AWL0^{39gQ<ENfyCLIjf41jQk<o5UybRYQMtidIfuU+%-!Q9hxYc?4
z=&z2ZFWh}~uCe=}{^--C5>&GNX|}0bxx&2HX6qp>e|Fk>%vPBi8p3;YXvk9}n}&wq
zl4)p2ft+vxcC2s=D%pguRztyI#RueIs{j~dSJ~W{3(l#BhGvlBhSc+CG~$ni_;%q{
z7>V7RcnB)UGYR5zJw@o3T!^rKgv=iy%g3nfu~ARBAKR?N`p1<PqVjQh1JOe~f~yz3
VbuvCjZupy?`e7HSSzoTm_z(N~EC~Pr

literal 0
HcmV?d00001

diff --git a/scripts/scan-calamari-cves/compare.py b/scripts/scan-calamari-cves/compare.py
new file mode 100755
index 000000000..61598b361
--- /dev/null
+++ b/scripts/scan-calamari-cves/compare.py
@@ -0,0 +1,159 @@
+#!/usr/bin/env python3
+"""Aggregate per-version summaries, compare against previous state, report changes.
+
+Called by scan.sh after every version has been scanned. Reads
+<workdir>/<label>/summary.json plus <workdir>/previous.json, writes
+<workdir>/summary.json (the new state) and <workdir>/slack.txt (the notification
+body), and prints the human diff.
+
+Exit code 3 means "the answer changed" - that is the actionable event for a
+scheduler. Exit 0 means nothing moved, so a nightly run stays quiet.
+"""
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+RELEASES_INDEX = "https://raw.githubusercontent.com/dotnet/core/main/release-notes/releases-index.json"
+
+
+def parse_version(v):
+    parts = []
+    for chunk in str(v).split("."):
+        try:
+            parts.append(int(chunk))
+        except ValueError:
+            parts.append(0)
+    return tuple(parts)
+
+
+def latest_patches():
+    """{channel: latest runtime} from Microsoft, or {} if unreachable.
+
+    Best effort on purpose. A scan that cannot reach GitHub should still report its
+    CVE findings rather than fail.
+    """
+    try:
+        with urllib.request.urlopen(RELEASES_INDEX, timeout=20) as r:
+            doc = json.loads(r.read())
+    except Exception:
+        return {}
+    out = {}
+    for entry in doc.get("releases-index") or []:
+        channel = entry.get("channel-version")
+        latest = entry.get("latest-runtime")
+        if channel and latest:
+            out[channel] = {"latest": latest, "eol": entry.get("eol-date"),
+                            "support": entry.get("support-phase")}
+    return out
+
+
+def runtime_notes(runtimes, patches):
+    """Flag bundled runtimes that trail the current patch, or are out of support.
+
+    This matters independently of any CVE. A self-contained app carries its own
+    runtime, and Microsoft stops publishing advisories for out-of-support versions -
+    so scanners go quiet on exactly the artifacts that deserve the most suspicion.
+    A clean runtime scan on an old artifact is not evidence it is safe.
+    """
+    notes = []
+    for rt in runtimes:
+        channel = ".".join(str(rt).split(".")[:2])
+        info = patches.get(channel)
+        if not info:
+            continue
+        if parse_version(rt) < parse_version(info["latest"]):
+            notes.append(f"{rt} trails the current {channel} patch ({info['latest']})")
+        phase = (info.get("support") or "").lower()
+        if phase and phase not in ("active", "maintenance", "lts"):
+            notes.append(f"{rt} is {phase}" + (f", EOL {info['eol']}" if info.get("eol") else ""))
+    return notes
+
+
+def main():
+    workdir = Path(sys.argv[1])
+    labels = sys.argv[2:]
+
+    state = {}
+    for label in labels:
+        path = workdir / label / "summary.json"
+        if path.exists():
+            s = json.loads(path.read_text())
+            state[label] = {"runtime": s.get("runtime", []), "cves": s.get("cves", [])}
+
+    try:
+        previous = json.loads((workdir / "previous.json").read_text() or "{}")
+        if not isinstance(previous, dict):
+            previous = {}
+    except Exception:
+        previous = {}
+
+    patches = latest_patches()
+
+    changed = False
+    lines = []
+
+    # Drift is folded into the state rather than reported standalone. A runtime that
+    # permanently trails the current patch would otherwise alert on every single run,
+    # which is how an alert becomes something everyone mutes.
+    for label, now in state.items():
+        now["drift"] = runtime_notes(now["runtime"], patches)
+
+    for label in labels:
+        now = state.get(label)
+        if now is None:
+            continue
+        before = previous.get(label)
+        cves_now = set(now["cves"])
+
+        if before is None:
+            # No baseline for this version. Report it once so the first run establishes
+            # what "normal" looks like, rather than silently adopting it.
+            changed = True
+            lines.append(f"*{label}* - first scan, establishing the baseline")
+            lines.append(f"  runtime: {', '.join(now['runtime']) or 'none found'}")
+            lines.append(f"  {len(cves_now)} distinct CVE(s)"
+                         + (": " + ", ".join(sorted(cves_now)) if cves_now else ""))
+            for note in now["drift"]:
+                lines.append(f"  runtime drift: {note}")
+            continue
+
+        cves_before = set(before.get("cves") or [])
+        added = sorted(cves_now - cves_before)
+        removed = sorted(cves_before - cves_now)
+        rt_before = list(before.get("runtime") or [])
+        rt_changed = rt_before != list(now["runtime"])
+        drift_before = list(before.get("drift") or [])
+        drift_new = [d for d in now["drift"] if d not in drift_before]
+
+        if added or removed or rt_changed or drift_new:
+            changed = True
+            lines.append(f"*{label}*")
+            if added:
+                lines.append(f"  NEW: {', '.join(added)}")
+            if removed:
+                lines.append(f"  gone: {', '.join(removed)}")
+            if rt_changed:
+                lines.append(f"  runtime: {', '.join(rt_before) or 'none'}"
+                             f" -> {', '.join(now['runtime']) or 'none'}")
+            for note in drift_new:
+                lines.append(f"  runtime drift: {note}")
+
+    print("\n\033[1mCompared against previous state\033[0m" if sys.stdout.isatty()
+          else "\nCompared against previous state")
+    if not previous:
+        print("  no previous state supplied - this run establishes the baseline")
+    if changed:
+        for line in lines:
+            print("  " + line.replace("*", ""))
+    else:
+        print("  no change: same distinct CVE set, same bundled runtime")
+
+    (workdir / "summary.json").write_text(json.dumps(state, indent=2, sort_keys=True))
+    (workdir / "slack.txt").write_text("\n".join(lines) if lines else "No change.")
+
+    sys.exit(3 if changed else 0)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/scan-calamari-cves/scan.sh b/scripts/scan-calamari-cves/scan.sh
index 879dd4250..935620bc3 100755
--- a/scripts/scan-calamari-cves/scan.sh
+++ b/scripts/scan-calamari-cves/scan.sh
@@ -7,114 +7,219 @@
 # scanners never see. This script scans the real shipped artifact instead.
 #
 # Usage:
-#   ./scan.sh                      # scan the latest main-branch CI build from feedz
-#   ./scan.sh 2026.3.508           # scan a specific published version
-#   ./scan.sh --local              # publish from the working tree and scan that
+#   ./scan.sh                          # scan the latest main-branch CI build from feedz
+#   ./scan.sh 2026.3.508               # scan a specific published version
+#   ./scan.sh 2025.3.417 2026.3.508    # scan several, e.g. the supported release tips
+#   ./scan.sh --local                  # publish from the working tree and scan that
 #
-# Requires: docker (or OrbStack), curl, unzip, python3. dotnet only for --local.
+# Comparing against a previous result:
+#   ./scan.sh --previous-state=old.json 2026.3.508
+#
+# Exits 3 when the reported CVE set differs from that previous state, so CI or a
+# scheduler can treat "the answer changed" as the actionable event. A plain run with
+# no previous state always exits 0.
+#
+# Requires: curl, unzip, python3, and either docker (default) or trivy+grype on PATH.
+# dotnet only for --local.
 
 set -euo pipefail
 
-WORKDIR="${TMPDIR:-/tmp}/calamari-cve-scan"
+WORKDIR="${CALAMARI_SCAN_WORKDIR:-${TMPDIR:-/tmp}/calamari-cve-scan}"
 FEED="https://f.feedz.io/octopus-deploy/dependencies/nuget/v3"
 PKG="octopus.calamari.consolidated"
 MODE="feed"
-VERSION=""
+RUNNER="${SCAN_RUNNER:-auto}"
+OCTOPUS=0
+PREV_STATE_FILE=""
+VERSIONS=()
 
 for arg in "$@"; do
   case "$arg" in
     --local) MODE="local" ;;
-    --help|-h) sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
-    *) VERSION="$arg" ;;
+    --octopus) OCTOPUS=1 ;;
+    --runner=*) RUNNER="${arg#*=}" ;;
+    --previous-state=*) PREV_STATE_FILE="${arg#*=}" ;;
+    --help|-h) sed -n '2,24p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    --*) echo "unknown option: $arg" >&2; exit 2 ;;
+    *) VERSIONS+=("$arg") ;;
   esac
 done
 
-say() { printf '\n\033[1m%s\033[0m\n' "$*"; }
+# Only colour a real terminal. Octopus captures stdout into a task log, where raw
+# escape codes show up verbatim and make the log harder to read, not easier.
+if [ -t 1 ]; then BOLD=$'\033[1m'; RESET=$'\033[0m'; else BOLD=''; RESET=''; fi
+say()  { printf '\n%s%s%s\n' "$BOLD" "$*" "$RESET"; }
 note() { printf '  %s\n' "$*"; }
 
-rm -rf "$WORKDIR"; mkdir -p "$WORKDIR/scan"
+rm -rf "$WORKDIR"; mkdir -p "$WORKDIR"
 
-if [ "$MODE" = "local" ]; then
-  say "Publishing from the working tree (self-contained linux-x64, as shipped)"
-  REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-  dotnet publish "$REPO_ROOT/source/Calamari/Calamari.csproj" \
-    -c Release -f net8.0 -r linux-x64 --self-contained true \
-    -o "$WORKDIR/scan" >/dev/null
-  note "published $(find "$WORKDIR/scan" -name '*.dll' | wc -l | tr -d ' ') DLLs"
-  note "NOTE: this uses YOUR SDK's runtime pack, which may differ from CI's."
-  note "      Compare against a feed scan before drawing conclusions."
-else
-  if [ -z "$VERSION" ]; then
-    say "Finding the latest published Calamari"
-    VERSION=$(curl -fsS "$FEED/registration/$PKG/index.json" \
-      | python3 -c "import json,sys,urllib.request
+# ---------------------------------------------------------------------------
+# Scanners
+#
+# Two databases are used deliberately. Customer scanners disagree with each other,
+# so one tool is not a baseline.
+#
+# Locally, running them as containers means no install step. Inside an Octopus
+# execution container the step is *already* in a container, so docker-in-docker is
+# not available and the binaries have to be on PATH instead.
+# ---------------------------------------------------------------------------
+
+if [ "$RUNNER" = "auto" ]; then
+  if command -v trivy >/dev/null 2>&1 && command -v grype >/dev/null 2>&1; then
+    RUNNER="native"
+  elif command -v docker >/dev/null 2>&1; then
+    RUNNER="docker"
+  else
+    RUNNER="native"  # nothing present; install below
+  fi
+fi
+
+ensure_scanners() {
+  if [ "$RUNNER" != "native" ]; then return 0; fi
+  if command -v trivy >/dev/null 2>&1 && command -v grype >/dev/null 2>&1; then return 0; fi
+
+  # NOTE: unpinned installs from upstream. Fine for an interactive run, weaker for a
+  # scheduled one, where a scanner upgrade and a genuine new CVE look identical in the
+  # diff. Baking both binaries into a pinned execution container image is the fix;
+  # until then set TRIVY_VERSION / GRYPE_VERSION to pin.
+  local bin="$WORKDIR/bin"; mkdir -p "$bin"; export PATH="$bin:$PATH"
+  say "Installing scanners (no docker available)"
+  command -v trivy >/dev/null 2>&1 || \
+    curl -sSfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+      | sh -s -- -b "$bin" ${TRIVY_VERSION:+"$TRIVY_VERSION"} >/dev/null 2>&1
+  command -v grype >/dev/null 2>&1 || \
+    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh \
+      | sh -s -- -b "$bin" ${GRYPE_VERSION:+"$GRYPE_VERSION"} >/dev/null 2>&1
+  note "trivy $(trivy --version 2>/dev/null | head -1)"
+  note "grype $(grype version 2>/dev/null | grep -i '^version' || echo installed)"
+}
+
+run_trivy() { # <scan dir> <out file>
+  if [ "$RUNNER" = "native" ]; then
+    trivy fs --scanners vuln --format json --quiet "$1" > "$2" 2>/dev/null || true
+  else
+    docker run --rm -v "$1":/scan:ro -v "$WORKDIR/trivy-cache":/root/.cache \
+      --platform linux/amd64 aquasec/trivy:latest fs --scanners vuln --format json --quiet /scan \
+      > "$2" 2>/dev/null || true
+  fi
+}
+
+run_grype() { # <scan dir> <out file>
+  if [ "$RUNNER" = "native" ]; then
+    grype "dir:$1" -o json -q > "$2" 2>/dev/null || true
+  else
+    docker run --rm -v "$1":/scan:ro -v "$WORKDIR/grype-cache":/root/.cache \
+      --platform linux/amd64 anchore/grype:latest dir:/scan -o json -q \
+      > "$2" 2>/dev/null || true
+  fi
+}
+
+latest_published_version() {
+  curl -fsS "$FEED/registration/$PKG/index.json" \
+    | python3 -c "import json,sys,urllib.request
 d=json.load(sys.stdin); last=d['items'][-1]
 items=last.get('items')
 if items is None:
     with urllib.request.urlopen(last['@id']) as r: items=json.loads(r.read()).get('items',[])
 vs=[(i.get('catalogEntry') or {}).get('version','') for i in items]
 vs=[v for v in vs if v and '-' not in v]
-print(vs[-1] if vs else '')")
-    [ -z "$VERSION" ] && { echo "could not determine latest version" >&2; exit 1; }
+print(vs[-1] if vs else '')"
+}
+
+# ---------------------------------------------------------------------------
+# Scan one version into $WORKDIR/<label>/
+# ---------------------------------------------------------------------------
+scan_one() { # <label> <version-or-empty>
+  local label="$1" version="${2:-}" dir="$WORKDIR/$1"
+  mkdir -p "$dir/scan"
+
+  if [ "$MODE" = "local" ]; then
+    say "Publishing from the working tree (self-contained linux-x64, as shipped)"
+    local root; root="$(cd "$(dirname "$0")/../.." && pwd)"
+    dotnet publish "$root/source/Calamari/Calamari.csproj" \
+      -c Release -f net8.0 -r linux-x64 --self-contained true -o "$dir/scan" >/dev/null
+    note "published $(find "$dir/scan" -name '*.dll' | wc -l | tr -d ' ') DLLs"
+    note "NOTE: this uses YOUR SDK's runtime pack, which may differ from CI's."
+    note "      Compare against a feed scan before drawing conclusions."
+  else
+    say "Downloading the shipped package for $version (this is what customers receive)"
+    curl -fsS --max-time 600 -o "$dir/cal.nupkg" \
+      "$FEED/packages/$PKG/$version/$PKG.$version.nupkg"
+    note "$(du -h "$dir/cal.nupkg" | awk '{print $1}')"
+
+    mkdir -p "$dir/pkg"
+    ( cd "$dir/pkg" && unzip -qq ../cal.nupkg )
+    local inner; inner=$(find "$dir/pkg/contentFiles" -name '*.zip' | head -1)
+    if [ -z "$inner" ]; then echo "no inner payload found for $version" >&2; return 1; fi
+    unzip -qq "$inner" -d "$dir/scan"
+    note "$(find "$dir/scan" -type f | wc -l | tr -d ' ') files"
   fi
-  note "version: $VERSION"
-
-  say "Downloading the shipped package (this is what customers receive)"
-  curl -fsS --max-time 600 -o "$WORKDIR/cal.nupkg" \
-    "$FEED/packages/$PKG/$VERSION/$PKG.$VERSION.nupkg"
-  note "$(du -h "$WORKDIR/cal.nupkg" | awk '{print $1}')"
-
-  say "Extracting"
-  mkdir -p "$WORKDIR/pkg"
-  ( cd "$WORKDIR/pkg" && unzip -qq ../cal.nupkg )
-  INNER=$(find "$WORKDIR/pkg/contentFiles" -name '*.zip' | head -1)
-  [ -z "$INNER" ] && { echo "no inner payload found" >&2; exit 1; }
-  unzip -qq "$INNER" -d "$WORKDIR/scan"
-  note "$(find "$WORKDIR/scan" -type f | wc -l | tr -d ' ') files"
+
+  say "Bundled .NET runtime for $label (self-contained, so this ships to every target)"
+  # -I skips binaries; the deps.json files carry the authoritative version and the
+  # self-contained helper binaries would otherwise emit "Binary file ... matches" noise.
+  grep -rhoIE 'runtimepack\.Microsoft\.NETCore\.App\.Runtime\.[a-z0-9-]+/[0-9.]+' "$dir/scan" 2>/dev/null \
+    | sort -u > "$dir/runtimes.txt" || true
+  if [ -s "$dir/runtimes.txt" ]; then sed 's/^/  /' "$dir/runtimes.txt"; else note "none found"; fi
+
+  note "scanning with trivy..."
+  run_trivy "$dir/scan" "$dir/trivy.json"
+  note "scanning with grype (second opinion, different vulnerability database)..."
+  run_grype "$dir/scan" "$dir/grype.json"
+
+  python3 "$(dirname "$0")/summarise.py" "$label" "$dir"
+}
+
+# ---------------------------------------------------------------------------
+
+ensure_scanners
+note "scanner runner: $RUNNER"
+
+if [ "$MODE" = "local" ]; then
+  scan_one "local" ""
+  LABELS=("local")
+else
+  if [ ${#VERSIONS[@]} -eq 0 ]; then
+    say "Finding the latest published Calamari"
+    v="$(latest_published_version)"
+    if [ -z "$v" ]; then echo "could not determine latest version" >&2; exit 1; fi
+    VERSIONS=("$v")
+  fi
+  note "versions: ${VERSIONS[*]}"
+  LABELS=()
+  for v in "${VERSIONS[@]}"; do scan_one "$v" "$v"; LABELS+=("$v"); done
+fi
+
+# ---------------------------------------------------------------------------
+# Aggregate, compare against previous state, report
+# ---------------------------------------------------------------------------
+PREV_JSON="{}"
+if [ -n "$PREV_STATE_FILE" ] && [ -f "$PREV_STATE_FILE" ]; then
+  PREV_JSON="$(cat "$PREV_STATE_FILE")"
+elif [ "$OCTOPUS" = 1 ]; then
+  PREV_JSON="$(get_octopusvariable "Calamari.CveScan.State" 2>/dev/null || echo '{}')"
+  [ -z "$PREV_JSON" ] && PREV_JSON="{}"
 fi
+printf '%s' "$PREV_JSON" > "$WORKDIR/previous.json"
+
+CHANGED=0
+python3 "$(dirname "$0")/compare.py" "$WORKDIR" "${LABELS[@]}" || CHANGED=$?
+if [ "$CHANGED" -ne 0 ] && [ "$CHANGED" -ne 3 ]; then exit "$CHANGED"; fi
 
-say "Bundled .NET runtime (self-contained, so this ships to every target)"
-# -I skips binaries; the deps.json files carry the authoritative version and the
-# self-contained helper binaries would otherwise emit "Binary file ... matches" noise.
-grep -rhoIE 'runtimepack\.Microsoft\.NETCore\.App\.Runtime\.[a-z0-9-]+/[0-9.]+' "$WORKDIR/scan" 2>/dev/null \
-  | sort -u | sed 's/^/  /' || note "none found"
-
-say "Trivy"
-docker run --rm -v "$WORKDIR/scan":/scan:ro -v "$WORKDIR/trivy-cache":/root/.cache \
-  --platform linux/amd64 aquasec/trivy:latest fs --scanners vuln --format json --quiet /scan \
-  > "$WORKDIR/trivy.json" 2>/dev/null || true
-python3 - "$WORKDIR/trivy.json" <<'PY'
-import json,sys
-try: d=json.load(open(sys.argv[1]))
-except Exception: print("  (no output)"); raise SystemExit
-seen=set(); total=0
-for r in d.get('Results') or []:
-    for v in (r.get('Vulnerabilities') or []):
-        total+=1
-        seen.add((v.get('Severity'),v.get('VulnerabilityID'),v.get('PkgName'),v.get('InstalledVersion'),v.get('FixedVersion')))
-print(f"  {total} matches across all flavours -> {len(seen)} DISTINCT")
-for s,c,p,i,f in sorted(seen):
-    print(f"  {s:9s} {c:22s} {p:38s} {i:14s} fixed: {f}")
-PY
-
-say "Grype (second opinion, different vulnerability database)"
-docker run --rm -v "$WORKDIR/scan":/scan:ro -v "$WORKDIR/grype-cache":/root/.cache \
-  --platform linux/amd64 anchore/grype:latest dir:/scan -o json -q \
-  > "$WORKDIR/grype.json" 2>/dev/null || true
-python3 - "$WORKDIR/grype.json" <<'PY'
-import json,sys
-try: d=json.load(open(sys.argv[1]))
-except Exception: print("  (no output)"); raise SystemExit
-seen=set()
-for m in d.get('matches') or []:
-    v=m.get('vulnerability') or {}; a=m.get('artifact') or {}
-    seen.add((str(v.get('severity')),str(v.get('id')),str(a.get('name')),str(a.get('version'))))
-print(f"  {len(d.get('matches') or [])} matches -> {len(seen)} DISTINCT")
-for s,c,p,ver in sorted(seen):
-    print(f"  {s:9s} {c:22s} {p:38s} {ver}")
-PY
+if [ "$OCTOPUS" = 1 ]; then
+  set_octopusvariable "Calamari.CveScan.State" "$(cat "$WORKDIR/summary.json")"
+  set_octopusvariable "HasNewFindings" "$([ "$CHANGED" -eq 3 ] && echo true || echo false)"
+  set_octopusvariable "SlackSummary" "$(cat "$WORKDIR/slack.txt")"
+  new_octopusartifact "$WORKDIR/summary.json" "summary.json"
+  for l in "${LABELS[@]}"; do
+    if [ -s "$WORKDIR/$l/trivy.json" ]; then new_octopusartifact "$WORKDIR/$l/trivy.json" "trivy-$l.json"; fi
+    if [ -s "$WORKDIR/$l/grype.json" ]; then new_octopusartifact "$WORKDIR/$l/grype.json" "grype-$l.json"; fi
+  done
+fi
 
 say "Done"
 note "artifacts kept in $WORKDIR (trivy.json / grype.json for raw detail)"
-note "If the two scanners disagree, prefer investigating over dismissing —"
+note "If the two scanners disagree, prefer investigating over dismissing -"
 note "they use different databases and different matching rules."
+
+exit "$CHANGED"
diff --git a/scripts/scan-calamari-cves/summarise.py b/scripts/scan-calamari-cves/summarise.py
new file mode 100755
index 000000000..64eef8c81
--- /dev/null
+++ b/scripts/scan-calamari-cves/summarise.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""Turn one version's raw Trivy and Grype output into a summary.
+
+Called by scan.sh once per scanned version. Prints the human-readable table and
+writes <dir>/summary.json for compare.py to aggregate.
+
+Total matches and *distinct* CVEs differ a lot: the same finding repeats across
+~43 deps.json files, one per flavour and RID. A customer reporting 42
+vulnerabilities is routinely reporting one.
+"""
+import json
+import re
+import sys
+from pathlib import Path
+
+
+def load(path):
+    try:
+        return json.loads(Path(path).read_text())
+    except Exception:
+        return None
+
+
+def trivy_findings(doc):
+    """-> (total matches, {(severity, id, pkg, installed, fixed)})"""
+    if not doc:
+        return 0, set()
+    total, seen = 0, set()
+    for result in doc.get("Results") or []:
+        for v in result.get("Vulnerabilities") or []:
+            total += 1
+            seen.add((
+                v.get("Severity"), v.get("VulnerabilityID"), v.get("PkgName"),
+                v.get("InstalledVersion"), v.get("FixedVersion"),
+            ))
+    return total, seen
+
+
+def grype_findings(doc):
+    if not doc:
+        return 0, set()
+    matches = doc.get("matches") or []
+    seen = set()
+    for m in matches:
+        v = m.get("vulnerability") or {}
+        a = m.get("artifact") or {}
+        seen.add((str(v.get("severity")), str(v.get("id")),
+                  str(a.get("name")), str(a.get("version"))))
+    return len(matches), seen
+
+
+def main():
+    label, directory = sys.argv[1], Path(sys.argv[2])
+
+    runtimes = []
+    runtimes_file = directory / "runtimes.txt"
+    if runtimes_file.exists():
+        for line in runtimes_file.read_text().splitlines():
+            m = re.search(r"/([0-9][0-9.]*)$", line.strip())
+            if m:
+                runtimes.append(m.group(1))
+    runtimes = sorted(set(runtimes))
+
+    t_total, t_seen = trivy_findings(load(directory / "trivy.json"))
+    g_total, g_seen = grype_findings(load(directory / "grype.json"))
+
+    print(f"\nTrivy ({label})")
+    if not t_seen and t_total == 0:
+        print("  (no output)")
+    else:
+        print(f"  {t_total} matches across all flavours -> {len(t_seen)} DISTINCT")
+        for sev, cve, pkg, installed, fixed in sorted(t_seen, key=lambda r: tuple(str(x) for x in r)):
+            print(f"  {str(sev):9s} {str(cve):22s} {str(pkg):38s} {str(installed):14s} fixed: {fixed}")
+
+    print(f"\nGrype ({label})")
+    if not g_seen and g_total == 0:
+        print("  (no output)")
+    else:
+        print(f"  {g_total} matches -> {len(g_seen)} DISTINCT")
+        for sev, cve, pkg, ver in sorted(g_seen, key=lambda r: tuple(str(x) for x in r)):
+            print(f"  {sev:9s} {cve:22s} {pkg:38s} {ver}")
+
+    # The union is what gets compared run to run. Either scanner flagging something is
+    # enough to be worth a look - they use different databases and different matching
+    # rules, so treating one as authoritative would quietly drop real findings.
+    cves = sorted({c for _, c, *_ in t_seen} | {c for _, c, *_ in g_seen})
+
+    summary = {
+        "label": label,
+        "runtime": runtimes,
+        "cves": cves,
+        "trivy": {"matches": t_total, "distinct": len(t_seen)},
+        "grype": {"matches": g_total, "distinct": len(g_seen)},
+    }
+    (directory / "summary.json").write_text(json.dumps(summary, indent=2))
+
+
+if __name__ == "__main__":
+    main()

From 4a9b06d206a23d49a6fc992d1ce9a21f9a7b57f1 Mon Sep 17 00:00:00 2001
From: Nick Josevski <nick.josevski@octopus.com>
Date: Tue, 18 Aug 2026 12:55:11 +1000
Subject: [PATCH 2/5] Drop committed Python bytecode and ignore it

__pycache__ was picked up from a local syntax check; it should never have been tracked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .gitignore                                       |   4 ++++
 .../__pycache__/compare.cpython-314.pyc          | Bin 8834 -> 0 bytes
 .../__pycache__/summarise.cpython-314.pyc        | Bin 6374 -> 0 bytes
 3 files changed, 4 insertions(+)
 delete mode 100644 scripts/scan-calamari-cves/__pycache__/compare.cpython-314.pyc
 delete mode 100644 scripts/scan-calamari-cves/__pycache__/summarise.cpython-314.pyc

diff --git a/.gitignore b/.gitignore
index 430eddbd0..88a9f5c19 100644
--- a/.gitignore
+++ b/.gitignore
@@ -205,3 +205,7 @@ source/Calamari.Tests/Some sample text
 # Claude Code: per-developer files
 CLAUDE.local.md
 .claude/settings.local.json
+
+# Python bytecode from scripts/
+__pycache__/
+*.pyc
diff --git a/scripts/scan-calamari-cves/__pycache__/compare.cpython-314.pyc b/scripts/scan-calamari-cves/__pycache__/compare.cpython-314.pyc
deleted file mode 100644
index cbdd9abfe2412c21a8b8a495fcc398bbf32ab461..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 8834
zcmbVRdu$s=dY>hiZ&G}SdQhUIwI$o4EKv{3FUgPCvLxHG6?sk3HlmZdB3BY)iez?|
zl0`RH;R>{L(u3{vuA-3umVsQO9PSYHkD@Nn;+&>MbG^eI9m*E7QDLJO;1Hk%{3`Bn
z?H~PS$z4%0<p3Q)!`<1LZ@&5Fo8R}C-6a+yg5v)9pT5~wfzWU8i(FLshv#p?!#tvq
zfJPBboFW85`c(-k=~pd~@T)qdIjI%2b%<6AI-0CNf}YkuZJ@PK8)+TXrtg?({eg=J
z1z}b<`i^NE>da39<A{3c-(z6DBoI0_Imxk;jKEScmTQ?|IX)DPP<(uPn&Cn$-%JIf
z(=mo)DQ1!hMR<XVaqLVe8s{lqfKkm9$Ht<ZKn13l$Rx{qjm91(9A<;m_#DLtn2493
zqL>MR<tP@2&r$LWQw&dyvn)&nog!?|OVKP7<c)`Bquk|Sh&$4HD9ntr;Uld%Ugo@S
z^1xUu3^T9yk(rS`HdC`)NMH+TY#7@pOtDmioy~FXp_oXpfD|8Q0++qQ6@kk2iwdEM
zP=FCY9LDizaL&^#4Ty1}h`>{r)Kq+$iBQ4N#00Fm_euza5Dl`_9%`CpB0RMn_ko95
zSbI)7!R=HFjAR5Vl%v1|FnMM?%wp+81ZpD6QH+rfOtHaunB}~bM7AwYF%lJ~LXk;o
zIy%D!n<+j@F;pZpIVFVWC@v176qq@ldMh4c1+Q_?Lx|)MBTOZHQ-ToVyINa0X4X3y
z5~kwgah~M@(TD(ZdSQcGgHa*E3ax=C$F@$xKDTmgm}Pjj1*T+q`HgQ0MS|=VN!S6<
z9i?dDNe%zcMX2VH7sZGX<+~qs=AVafpG}2UzS>Y<EkZF>HS!ZfnoZr{bwnq(`BgGS
z`L_-YPzV`NEgCT?y$JbhJ)+QvUT)W-U^zY(b;wtAo>7IPI#h!O&L9**-Rc??B0!>q
z*P|8HyugVXJ{ArMqLzup*ho-RgIb72KNF6#y&M;X??OBlW<6?=m=QH_f&^aF1g7GV
z%RH9CPKpwZ`J?5H&50K1!Lwue)4^Gxixd9&H=vqFS#!yJ@0#6t<J@1CFSu{IQ-O!}
z?MclOmD=FWn(f!mTs!kYX=?cWs)y!=ryAs_e_=#s`;D@952eY9-@nixTh$9hD1B4*
z>#sji!}}k2JJ7#Vb<C*x)aX9er1{iCKplWar5NA|I3}N)0jTCtH5ySq4av}@v>;S;
z=dgZAWz<O%`}3o^i7_IsimS&IaEcY|(vSq0^0?gZHsnV`mW^%rO$Il4zheZg!hfB4
zeXB#QpjQ`(A-vj6g;vX>x`|!+Z<8<%>xUPCPBNgAYM;93SW+GvBe&?GQF>^6<VN}f
ztqA!vo7xT{L~DH-TDJu~y-bfbY|+Cg_h?mLYS;-Y8i4J@C&Q=0=U_KdW`uokqmT+~
zd7bok<_9@FhtpCbiwRB(>>idzD~hXXQ2qL8FeR3+VqlA~;Vvo+#sI7Xz>pA{X5XeJ
zxac%>HWc8Zd~`x+rU2NkzD<QDsCa~985jnj2e5e@4`L?(_XG;Vdz_0!dDcrElk7qc
zEU|%z0%<&q>JJGg<Kq-R6^)03fOw&BST;c+fj9Q}d#MRPDS%0y;sE^sd;xJI)C3a>
zdyQ~{b(p_sTo_E0<UuYEYYA(9F|rj*l;jrGl3$dl&Ap3iHX2Uop=t@jszn_ik6{~_
zu;d?FVqo1^k3rPNxo|i%F6ub;tvIYy)ImcO@Iox1d(ZS9JKuYL?9||i-isoMt(&L`
zN5KY)BrG*38hWn;*cdhtqI!}Q0CxyZR0pF0Q4Q>i8o+LDPSoX@<{YqNJU(cYR5-kY
zVtxf<F-8EJ!gKY|2q262EL8L8iJ8<m)-0vhN3V^pTI%mx>OUO3dpvEaU$q=vu^heE
zzUC-jXnL<Hb?&zRmjC^W8OP3K&+pWz<Tc`n9+@ojJz2YRq2gvm+U3dEn^x^@X?xq!
z_!suJq$caASn%BRq}?qUhc~Iq+RGPQH(lxK-5GmxQv1l{xVC>`=H^V+-LN>Z#4Zp2
z-KD>|bT^UNdphghu^9ho?#|qDU1rxYz$teRk?eW*%u@q$v_CN;vvvOT?<z14z~%pZ
zZE^y%X&hOr{T%~z);Rvadtq_kYw6j8KH1SjX+Cx8;qf!d)YE48Y&VIY+tj$;V>zK#
z|FepKI#7sY3gWdvt7Oeoen5g=qR))6fF_3W_6(*`%19n-5b`UCQVa`e#VXON<|<{l
zVsm07SU=r*yZq!|#~O`)GitmJ))8|pmG$`x+BCGf*lY(tYl7SH`Sz=Z6w4`7!fP=j
zn)H)U!>k)=K%2HhE2B*v@@tCmP3z<yFXJn%e-)a?w0^CERT3f(d<Gn8Y4bsle-5Ju
zehC=5HRlGu){HvTTX3czr94XzY>OMwCRnMlP+CAkb(Wy@&Fg|u_Nxx`VgSrFMp!=}
ztjEIqF|gMcW+tiecqE8j;XHm|pAURLfdeRlN0ti2ISzY$(&>~S5<A*(xT)v_xZo0~
z07m+zz+IeX1aP8x3VUGK;ec`A^+7)-GDiXGNs!5gCt9#u2Ob<u3!VuTU^wi?Q-F<B
zbT(qlvy$^=6?g_5jmCID-|=vWmt0IHI1}Qd(opP^0#7Z`iIzN1vJ=l!Ek<xca~?eK
zHW|%1pBTy6E8yG$hmsS_fiDfOc>x4j@IGf)>C<!+@Sl(Ku}}bj&TBkI1;Fu)$Rf*G
z0U!rWQNVj}qa;e$fyOogLJ^QefQ9wpCZ3r9qr#D}PhErG;4?ia;bOv>lX}kUmc^dX
z=Oj-xiiC&5?v{uWB&Nfa!b?KiO!dBgh5{E(iyieDRy1MX7@TGXrWDm-f%oVDxuc;7
zhy7I!qc2y3E9}2<_!MJEhX4Tj>18btb$K)vHIjENsyKmzGl)bo6q$&Evxuz+k4NtW
zHxWt>%Pn~VW6~&Y4}8b}{C`0OP;NsOD>#WI<w;f6QMS-{v+;vHDenFKw-4Vsyi}U0
zZdn?CP~Dz!bO07x%dcO(b~Uv>W35k;kF2F%nw@K=%9JBxa)0pll5e^3r=yv=Lo233
zdFL{9Jk^=5+q2xieDLncd%n*b|7A3N!k6|9r(OOP^M$OvY@zaIWeRLS!>YY0ZEspq
zt=ih}+uAd>JxR?YlkM8x8^h`C#~+p*FQAwb7JC=>r(L^0cmBHa=ap&t!msQ8t!}ye
zE_rwOA5F_|-*4?rkN(jE7qe;}e_D#H6;GVt)y|)J4hu#BT*(FdiWq;NN8o85t;ZfC
zSO=ssgq31b86^r&xr|fbg}!nWy<t?0z`muQ08eoSTZaqk<^miAj4yZtY$uChr0l=S
zIF!e>CO~y1YT3dcCSQf1%8CHF0Ryp8ZYs3ei#qeG1)MM5hg|Q|s=81w`IJ|3hzHTY
zw{ZxTqfiE~;<t!}Q0z-gJEC~+e(ebMcBCS6zfpFuC)yE6wB-Bbe`7jY7t=#@Y5<$z
zlE1G1%KHF&S&h&v$c5_~fu~&Y88_NLpH7||zUU>Xz}c5PZP12ZRo^e9$U#+1?mopw
zh#7sxiJWzVnS9!B>1`Up_#zdUl`N{iW}j)|Q^}GUV|t%qs7@ZS{!5#D*s_~D6h0st
zF5c5Zmke!NA1Oa=mWHfrMfT8&?Wg>G%Xw@g^$KmX+#7hbcc^`4d3STZ3hgM))5wmO
zDae!xZ8zBR(!zJS5AX&%StwJ`1kj?GWeeFjeU^=D8vw1s8UQ{4XivdjnTqWzt@v~=
zOAXE(xDmL-O4iqP=~vAKak0|FTF~P^i}tXM$Rb3(;=CxD@Je3nK6?SBO(#O;=fEUz
z?I`G1d`2afedUa$FYn2)Gp_PNG};F-PR!|Z`brBtLNlBq=b&o9mfML~8T7Eqi=TAk
zbK$co?_l-e-J!h0Xm~GE-oa|P@os(tarw8MCewz~q|6y?kZ2Y^U1h~J*=LnyxlzB?
zIe#V9@-3*^wxFu4KX~pHyl#aAcA4tS`$$*739j6Nn=Q1bIF%0NtiUNP`+uKH)xfWE
zdNJb3oh~?~>((AD?&dPovbkkF-y~~EP{ME81-Mcr%L2Guk6t9LTAz`wF6gCKsK891
zdj?n=;8?7@puf#mKGga$AGC=sm2FUQJR1Pw7>~}H3aGgYW`_%f4c58+<yi_We8<aQ
zw?X_hs-lf_&3^2GLD@jP_S>lY49fb!rbF~qSJc`VWU3%zN`9^@+&kHL=a`Uc;B8&H
z5FfkIsDg5E5n`x^i<Wg-_?<!{fC#w)nJ*n4BV`Y@HK><7(<Ent<B&Crt76U&@@)GC
z<8&8?ZO`Cf!d!Ue0EwSmK1?J7Gc2F5Y`CvTsII=<Cu)LRXhInDi9}Pv(*zd;6Cn=A
zM3D7rrXXhoiL!i5hC``w2o1sz-6c#A7UXDmQ3+Kul`ux45f&~GAm&V{C@Nutn+Zsd
zMFIj24;y(;Le)iaSl9`>GM17i2MRih8tlCQ4|)p1xCq-ti6kZn@leYVD$!`HexrT5
zCwCPDVOY_-pz1f;rW2I$TY4p4qabwKbd4lMyWtQ7t@wfjM__QBp)4Na*9~hwAW^`H
zuSsB(XQtT=Yo&M=5{^>yrU=}l616yhhE%-)qFZ6?GCRj749eAyNEj2w!D#-v#_Or(
zFg8HGe-4sz3^zF=YS}9wRi4A%BZt#Bq5&uC#sv0?AccOSF~sA0GATqPgQ0-Hfz3fu
z=1tVV_0%*kg>FEU6{HZ6+bzuzhOD3#GsOl)61E&Ne9~PLGzvkS@Y9BP$N@mc4{qGx
zu8I|n(sh?KHE2<MItEMvdxEDz)a7r{aLN)c(ctPqx~+p~6u*ijM4(e5!HarXAvv5g
z%Ow*hfdLKHF<w+hqO+oQoP`tsE9$WdL-09^H3QO~Ch0x@QNsj-Fb;T=E~h{$!dU*3
z5gv1U6%@^qzR6z*NOI;H;8qSV8s@}KJC1palw250;uxHpgl?zcpWgu%dLFHnIDW8a
z;lRxUsbfFv&Xm;6_pe!O*DqeXcw_wgBlCTa@%_nH_6o>KTFbxxCyTWYtgT5hYqDPN
zzSe#H@LwEWvpE-x?-^5_w~yR9l7SqhtvPuNCnDeaD1Iltbm^`tv#a~A|K7QO9sYFq
z^L^>_!<k-xy81%0H<y>Jd}7vU%GXLO7P{W+O3g0SJ*YddTHABKwkK2DyIOlTU3>O(
zXQp&8sb90YQjH&;Shae-uzIo;uH?xVdStE1l+@1mKQ1Yq@0ad+o)}Sud*SlU%YQX}
z&6w1zRWvM~Uvm9ubooN2;&4)(?0?t%RE;VcUTBe{5>{1GdOdV4l+pm1q&jOVd8Zpf
z`mEh0T^6wrmM67qrR6vH)V?2H&6L(B^^Z;VcaA*KqKfJy%qZO;rP@=&ss42RnY8Qd
zig{3O?Oqh5WNhj3rN6Ds?0Ri=*HC)b(7iM1o#)andc}NR?%44`V6pN2>C{-d`B2(*
z_|fsxsS}HxA051N@F)J|lbM#onffCS-AB?x^na^~Djxx9Tgx!<xUxFcf7_fg-ypNL
zvIX-^bGoi=*}1Gu*X)02I{>S6?f4I~^Xqa~YUk~yTTP4pOjYx0RY$t2V_B6c-;*@0
z*~)KRc~H@kv3WsKj>=T^16OOt(U#P$IV)4;x2tYdEuPA_ysNIxw5xM@d&appX~>q<
ze%P?cFCF~RcQf1f-7njhG_F-tr}}Q6zIA$WHsfwxb?;5P_bzv2D)uGKS*m`q|F6v%
zXWt!js(qQb>%QOCyKwHtxjW{hA?@t@t;x2~e>?HXr5|6)mRD_(=wf@yy<*<^$m+~5
zFg2SOX<261{`AfR>6(KpwysCka{2p}CGr!)$A;xynZ~a4uI_Zrp%vTVM^=~o{pwQZ
zCkH=1xO^$I`{?TKQ|aBO?(IuAozB+PFP`}5)SXjHfo0E6BbkQ7s}23>hW>ly>H3q9
z8m~Q#Wo{oJep9)vxU^q@w6{MUAV8^JK$2Ty{0IJLiN8;*9v!-WbZGS`{l!uGzOg%N
z?RWu+_Rim$O4sz3bji?){@f#7$yZKS^28ckJ2s@8x81kgi-DyM5c>m%_o2D<nHrT<
zfwme-(j_NX^rs$c%*pRQ(A2Dwp8KTdCk>x8{kUm)_+EQ@$hXooyh8f3(BbL>P1P#7
z^FF!rXM1Ilt?b%=FT6sY|C-eO`N{8{T-cR7_mJF{dJC%Gzvx#Xa~Zx4D9@Iby{pI9
z0p<VuY>+@@{R9tgIQpmkExuax*^WA>f3e5l>(Ks^&_caZYw@+JSG)w&qJC@)W6ao?
z$0F*+#^A<fY%B-(M}dS`lDpLL=I?a4GTexBdQ))KBN+^?5}I;3KpfLbcrPIqCLIBD
zH8%D!;;_S#gEal2=_tPMKf*<z4Z9P3KUBazK|Cc51o_;F2=iCS_!TPqcU1Y<J~?0V
tOsgX*pE(_b^;uIXVSm<46U6o>Z>kV!P9|2=t}jXbpY_4%A*-Z`{tte8Rek^f

diff --git a/scripts/scan-calamari-cves/__pycache__/summarise.cpython-314.pyc b/scripts/scan-calamari-cves/__pycache__/summarise.cpython-314.pyc
deleted file mode 100644
index 393bf4545e02c08fc98d6c6b8a2d48cf9331a94b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6374
zcmdT|eQXoS6`%F`W9>NpiU}c*WJ4gtNpJ`x<s*<QB;*J=XjsCAwjt5R-WY>p`*znM
zaeI|}m8#HFg(*}-YE_vY(j|o!OLvv1dew32Nu^S&b8sN(UQSo3Csp?!N6@MCufAD(
zH%>?odjEB#ot>RG^WN-x^Lz8&G}wwQ2+GIzesFGgF+%^qA8OI%8%rb5NFWADXb>?(
zHz5(qTPNw1Hz|?u)^+QT7$id#V#xJKGBSFoO^g9*iZMcMK4W1_drl+d2Z@`|8FMvi
z$qRrvM2+%zDDEPGP+v?4(~&SwkMV*SjD)v|w7^}U`-I@w1kHv0^vl9Tl&2#xDH@aL
zU|5RK94*F1M>%1_Yq4~2p%Cw<hbL&!$A!J(S>Wa4=_oHK9bus58GGqo0j7(zbe5;j
z#zwjDc7f;o+;E7eC8Y*wmJ32q;zfGDKPa>}sbbEFkuW_H5oljzG|CCQH#$M%bp!$e
zAK)Y&*3lP{xDY+cNxri%9k09I9~7lv*eBJ~9qeI|_6J8sU{xF)ib(sEMTp!ePmct{
z{$Myj3w)I4V0D~Nh=`))do8<YKOYsnIoZJwFE%P_!hbdr;>IE|;00os?oKa#koLty
zDKZK);1dx*Zh&stX&H-!!o0u@2SY(A2<r-hazT^9Fdv#I7zyh4T8?`NS>MY^XMJE5
ztr(z1!n5=`R0*^Z4QQlZb<=1)2vws2JVPlgYRPlzHK~2eZ*@bcV`>nM1}K$oM1J72
z300vA*o-wOh}y^s6eMPd;~s;o$4Ze6p$O*}1-uH`j7>Qt@#B(gK0NN@qY`W-{6kUr
zArUX5R<`EM85FVoWIdiO6amEvkJt)T0zJ}^2KS=9<Wl@c@t<#*l73b{U+$eP_h!p?
zWbMrvs`+1wMeZkvFt}xV$s-cp{}!z<^Yz9ibi1gX`~%TWu23K559-q|{SwxYKrGq@
z9k>Jlftvth19=r84I#U9HEZ?@)hz18rdU-NLRDcKp>c<CSb1LLKwXy*ijpk3=3L!#
z=8nQ#JxdG{jj&#|L<v^ctC?BtMTpg}DT7pH{1>|ZIdsEw=*H*JO)7nt#;FSRL=ZBg
zO4M^X_wILLy?dy5+xB+4PAWumBmJE^kq0jllqMSKpudrho)17HECS@g`7{EC$9cc!
zHIHm!crg}|MA^=+M4n8Y%yU>tn&|G7O}*y>$H5iIj&7ADoAZUTwF`63e|bom6nRM|
z1GwV+en0~0kN9MRvRqj&@_bk}3d#~>Voby)s->X_*zwCY3H#Kcyu%TNP0(2ekN8`t
z66l{rwgtQ6YR#3cljD>21y{+{lUGhnwk){TUE6kf+mt8k+A{B|&$#NRb@yHMlg0(-
z`fKHv%QKs{XPw@8XG_M}lHPpZ*)n->!Rkz&`0>%n!wXi&r6U)QEI6Fk43`bbb6H1q
zs`;(f>#Z5jzHCj~ofGe!`rWC!d$R|Q<%eWS>#`2dbo1@jnbve=w&ClK3}mV83q%&%
zmkh|&`Z<Y88Xnn@)j8Rg(U&g4!qHlILrY)$Pk8$($chrrVmGQ|2|(O$z8d11FxJ+_
zsfM9vF%Gi~YvXZ1bGy$&o{Es?&d?CF#tg%n=-1Hs!ZS3ysxx+J9s+Qi&f#^yjBSq#
ztNA}xm&5R9xLY>m4`aEw@D!YoDGrXu5zZ&cl!|Iu7xc^eFvg%MA1!zcf*ZI9>u^<y
z`H`X|$Yh8QdyK+*+)LwX111rp!bauIiAH!Um{UO)z~Rd>=o)~Iy|nlNR0;ISO3>My
zmjV|9$zaw-&)aG<w%XL8#LJ6Cwl`W6ogWpuCy51X@ukBT4=0<l*3I+Qx{S3hHN4zg
zpS4!ZTWd1bnv@HADeEQbB6YPU$z9_w^HWE&rQ5Qux?45V+--h_Pj}utpRM1w=vtSj
zcU>6;jNkB0SKr<`vo&o7Vz#yoPC3_sFA!mF|J;OZ>z-JU)joOQjr~*ZOi@KfUm;Y$
zkNDuxiXB?`oLc$?IH1IH0tPr)%C(sV!NZq_8H2jQS?WF!9A1PG$PkVA+|3u|?9-5-
z_AZ~d>Y3?};WHEPr|qm~$MzQRRjFzq1Gs1KX*qxc0;TlY)YkI58lq=FBaS&%6_rm*
zKCA*%8`QN0l=Hl2C+v1zZ^^2O@W~o_@kU)$1~p`;8Up<E<?(~Juu=x_7FG(YMFZ;i
zsBQpnY^4lfLn{R|OcrWb9j(4Ez#j;Kfhu+UikbT7&b&BKt<Gc&EV3fTxKs0gRfsid
zS^<QD#f*bU$u*RSs$j0>N2<`Vv4VbzH3CobK#eMe)kZ?UWvAxjs?dO@CDz0gtw)S?
zciuW+?QVoFzz!E~3V)5-3i%Ig)i_&JoiN44h_Mw=iZqIS6~(Gi9IGhB8pR0|7i+Vk
zotgx&ZBO2|%la!>Lx1K~`lDVzf5!^{kEK9Q?gIUp)pdP|{>;p}Rr;ere|klKAFkkT
z$?1wMVie7=Rz}eSYlpw3R7vo+n^*5-*5p8^9H*QyatDg(x*(Yt(?uOoXVk$u&+B?1
z2*MFxj8uBeFFv->q}mg_Mm}DTx|mWHG3!|!Q^vZO4NN&}WHuJ)MB7tMI%X44sTEXB
zV@<jyL$m}CRZ)nGUe!d)g3&;o`q5jjwwB-3h%Fh^F_r56RM!dlc2x~%qbmR3!4+)}
z{TcqBxK)USrQj$pdZlqG?r5s}_Kxj)&)~{?rrxt9Zc#!<B^QlbloKu2rYyNUy-p@P
z@nV{;3rF&qx+kuq={UWd5i4me4FR*7y^1tM+Ho`8*?qFF`*=s+iZ~AT1;T!A>03}0
zo*`|-3EffTSCEhM8wRb1tjeKfPhH?CkL!8>m)O>=#u`XTSC3J31MxobjMQCN>K>>z
zL;jRNeW=R;UcDgJTaGuzQ3CEjdR#eKI8ALOgM@(BK0^rDgflu>=iMO_<05t&wfUI9
zyg$H)`SGaGE_+6~VA#7q6!CE(u^k%R=&+x|4YfxddIT7V*ad$EtIC}4&kp-CX9nk(
zQyI2@o;jUiPG^UGPnWRp*UQQwQHHc277g*xAcR~7oJ#{JRft@=ws1uffD7b&c=#`e
zXBAo56aEhmXI}B&TmGJV#jhOxkY<zT`3YIKSCk1_CU@=>WpdXZsG3{EIF-we_R(?5
zlDo>Oi(9pA0bAf13;aLZU1$cq32;uMLW>Knxc6&N^<oM>a1|?d_RpSTGrcE1IC;<c
zC-yFzJ;gp1cH^;l0}A`_V2saN#d5-a+<5>hg-gyt@5SDY%_@Ado&E2{GB5StS^l1T
zsb8@WT$OOcd`LFsVJ_=^W4s6(1Sf<74IE`ky{(cB3clm{+mZ<d=wM<a+*9#k>A0s9
zBH;;9)^kE&EO+^0<j3KvOBAr1lr3TuE}KGd#U#o)ftQUU&k4S>vH`;9U{p48(I_AG
zV=0jse2Q>c#rt!yHcm*D8yNvd$+97e@9PBY_7pJ5xyw1_mPY`9!w7$DG%9-BLKprr
z!<`-PlOh7d_^LmXi`5o{;2|DvePCgN2M;$%L%F=!C=Dr@vnil<1acjaZI8($s7fXw
z<Co1^#xEO`j9(@pS&)e#neYi1G_omwVJL!oLOAhWU2+K2W84YnVN44=;%nd=5@>OK
z`L*%O<0;~&-?`CwtK@dsOj)}6*Bi52S||7Z-R?{rS#VdRY!BSt#IXgFd)~Bh*0gcn
zRB_)_vEZ(rcQ?$s8?x^0^X@&f?mZ9P`zAXV9j<HUpO`b{+oz@5@tOF|?`9qQCl7vN
zcU*jR!BKY2e%YQP-ZEV`O%rcg9y%HzykFP$ghGzetG=l^$OY_M5=TBQ-EyOE+LI1F
zs6Uk5+L0~o{Qfr}BU!WeQ@wezJIN>erw(Q;m2>*4Pl}w$K+1VFv`7_CMjlX=pHjt1
zU2=EQliAqzZpU5Y?|beXxM$ATm^td?VpD5+WcHAMzKNf;HcWOTeJOqsE)ou16{mJx
z8Bghwqp9W_C#Or^JU#789Zy%k({YD<`^cS>>Gr$M4|d(1_+xtpoZ%rh!wzPK{Fy;M
z;~IHr4ZxMbjuGOC5g9Bmy1J?Tx5(+Pn?<SD(%l(b`yBPs;^w;P(%IJj`OT+it(ACj
z%F>eJ)XwDDDK15(I;JM3iRqeY-}Hubb-E+nnsM!YXx#_WYraW5u_CMMIy>iTyv|OQ
zO*y9yrid%e*V+57#`kOIn!4YwO`lD3cbs=lyiL4cd%vmsfvY=PbTrZV$cW62<hljQ
zncTBL*^>GN%AWL0^{39gQ<ENfyCLIjf41jQk<o5UybRYQMtidIfuU+%-!Q9hxYc?4
z=&z2ZFWh}~uCe=}{^--C5>&GNX|}0bxx&2HX6qp>e|Fk>%vPBi8p3;YXvk9}n}&wq
zl4)p2ft+vxcC2s=D%pguRztyI#RueIs{j~dSJ~W{3(l#BhGvlBhSc+CG~$ni_;%q{
z7>V7RcnB)UGYR5zJw@o3T!^rKgv=iy%g3nfu~ARBAKR?N`p1<PqVjQh1JOe~f~yz3
VbuvCjZupy?`e7HSSzoTm_z(N~EC~Pr


From 367e6517f6f4229b0dea463ea532897d1096d5c2 Mon Sep 17 00:00:00 2001
From: Nick Josevski <nick.josevski@octopus.com>
Date: Tue, 18 Aug 2026 13:16:01 +1000
Subject: [PATCH 3/5] Fix two failures found by the first real runbook run

Artifacts were registered from /tmp, which inside an execution container is gone by the
time Octopus collects them from the host. Under --octopus the work directory now defaults
to the step's working directory.

Exiting 3 to mean 'the set changed' failed the Octopus step, which skipped the notify and
save-state steps - exactly the case that most needs them. Under --octopus the script now
exits 0 and signals change through HasNewFindings. Outside Octopus exit 3 is unchanged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/scan-calamari-cves/README.md |  8 ++++++--
 scripts/scan-calamari-cves/scan.sh   | 26 ++++++++++++++++++++++----
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/scripts/scan-calamari-cves/README.md b/scripts/scan-calamari-cves/README.md
index 4f50e5ea5..c7b8f8661 100644
--- a/scripts/scan-calamari-cves/README.md
+++ b/scripts/scan-calamari-cves/README.md
@@ -11,8 +11,12 @@ Run `./scan.sh`. Takes about ten minutes, most of it downloading a ~270 MB packa
 ```
 
 `--previous-state` makes the script exit **3** when the reported CVE set differs from that
-file, so a scheduler can treat "the answer changed" as the actionable event. Without it the
-script always exits 0.
+file, so a shell or CI job can treat "the answer changed" as the actionable event. Without
+it the script always exits 0.
+
+Under `--octopus` it always exits 0 and reports change through the `HasNewFindings` output
+variable instead. Octopus fails a step on any non-zero exit, and "the set changed" is
+precisely the case that needs the notify and save-state steps to run.
 
 ## Why this rather than `dotnet list package --vulnerable`
 
diff --git a/scripts/scan-calamari-cves/scan.sh b/scripts/scan-calamari-cves/scan.sh
index 935620bc3..67f824ce4 100755
--- a/scripts/scan-calamari-cves/scan.sh
+++ b/scripts/scan-calamari-cves/scan.sh
@@ -15,16 +15,18 @@
 # Comparing against a previous result:
 #   ./scan.sh --previous-state=old.json 2026.3.508
 #
-# Exits 3 when the reported CVE set differs from that previous state, so CI or a
-# scheduler can treat "the answer changed" as the actionable event. A plain run with
-# no previous state always exits 0.
+# Exits 3 when the reported CVE set differs from that previous state, so CI or a shell
+# can treat "the answer changed" as the actionable event. A plain run with no previous
+# state always exits 0. Under --octopus it always exits 0 and signals change through the
+# HasNewFindings output variable instead, because Octopus fails a step on any non-zero
+# exit and "changed" is the case that most needs the later steps to run.
 #
 # Requires: curl, unzip, python3, and either docker (default) or trivy+grype on PATH.
 # dotnet only for --local.
 
 set -euo pipefail
 
-WORKDIR="${CALAMARI_SCAN_WORKDIR:-${TMPDIR:-/tmp}/calamari-cve-scan}"
+WORKDIR="${CALAMARI_SCAN_WORKDIR:-}"
 FEED="https://f.feedz.io/octopus-deploy/dependencies/nuget/v3"
 PKG="octopus.calamari.consolidated"
 MODE="feed"
@@ -45,6 +47,13 @@ for arg in "$@"; do
   esac
 done
 
+# Octopus collects artifacts from the step's working directory on the host. When the step
+# runs in an execution container, anything written to /tmp lives and dies inside that
+# container, so artifacts registered from there are gone before collection.
+if [ -z "$WORKDIR" ]; then
+  if [ "$OCTOPUS" = 1 ]; then WORKDIR="$PWD/calamari-cve-scan"; else WORKDIR="${TMPDIR:-/tmp}/calamari-cve-scan"; fi
+fi
+
 # Only colour a real terminal. Octopus captures stdout into a task log, where raw
 # escape codes show up verbatim and make the log harder to read, not easier.
 if [ -t 1 ]; then BOLD=$'\033[1m'; RESET=$'\033[0m'; else BOLD=''; RESET=''; fi
@@ -222,4 +231,13 @@ note "artifacts kept in $WORKDIR (trivy.json / grype.json for raw detail)"
 note "If the two scanners disagree, prefer investigating over dismissing -"
 note "they use different databases and different matching rules."
 
+# Octopus fails a step on any non-zero exit. "The set changed" is the normal, expected
+# outcome and the one that most needs the notify and save-state steps to run, so under
+# --octopus it is signalled by the HasNewFindings output variable and the script exits 0.
+# Outside Octopus, exit 3 still lets a shell or CI treat "changed" as actionable.
+if [ "$OCTOPUS" = 1 ]; then
+  note "HasNewFindings=$([ "$CHANGED" -eq 3 ] && echo true || echo false) (exit 0; Octopus signals change by variable, not exit code)"
+  exit 0
+fi
+
 exit "$CHANGED"

From 278b77d999f48f700638ba620d74be8d9c654269 Mon Sep 17 00:00:00 2001
From: Nick Josevski <nick.josevski@octopus.com>
Date: Tue, 18 Aug 2026 13:22:36 +1000
Subject: [PATCH 4/5] Render CVE lists as linked bullets in Slack

Each identifier is now its own bullet and links to the advisory. GHSA ids go to GitHub
and CVE ids to NVD - both schemes appear because the two scanners name the same
underlying advisory differently.

The report is rendered twice: Slack gets bullets and links, the task log gets bare URLs,
which stay clickable in a terminal and readable in Octopus.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/scan-calamari-cves/compare.py | 62 +++++++++++++++++++--------
 1 file changed, 45 insertions(+), 17 deletions(-)

diff --git a/scripts/scan-calamari-cves/compare.py b/scripts/scan-calamari-cves/compare.py
index 61598b361..92647a1a6 100755
--- a/scripts/scan-calamari-cves/compare.py
+++ b/scripts/scan-calamari-cves/compare.py
@@ -70,6 +70,17 @@ def runtime_notes(runtimes, patches):
     return notes
 
 
+def advisory_url(ident):
+    """Where an identifier resolves.
+
+    Both schemes turn up here: the two scanners name the same underlying advisory
+    differently - Trivy reports CVE-2026-44788 where Grype reports GHSA-6c8g-7p36-r338.
+    """
+    if str(ident).upper().startswith("GHSA-"):
+        return f"https://github.com/advisories/{ident}"
+    return f"https://nvd.nist.gov/vuln/detail/{ident}"
+
+
 def main():
     workdir = Path(sys.argv[1])
     labels = sys.argv[2:]
@@ -91,7 +102,19 @@ def main():
     patches = latest_patches()
 
     changed = False
-    lines = []
+    plain, slack = [], []
+
+    # The same report is rendered twice: once for the task log, once for Slack. Slack
+    # gets bullets and links; the log gets bare URLs, which stay clickable in a terminal
+    # and readable in Octopus.
+    def emit(p, s_=None):
+        plain.append(p)
+        slack.append(p if s_ is None else s_)
+
+    def emit_ids(ids, indent="  "):
+        for ident in sorted(ids):
+            emit(f"{indent}- {ident}  {advisory_url(ident)}",
+                 f"{indent}\u2022 <{advisory_url(ident)}|{ident}>")
 
     # Drift is folded into the state rather than reported standalone. A runtime that
     # permanently trails the current patch would otherwise alert on every single run,
@@ -110,12 +133,16 @@ def main():
             # No baseline for this version. Report it once so the first run establishes
             # what "normal" looks like, rather than silently adopting it.
             changed = True
-            lines.append(f"*{label}* - first scan, establishing the baseline")
-            lines.append(f"  runtime: {', '.join(now['runtime']) or 'none found'}")
-            lines.append(f"  {len(cves_now)} distinct CVE(s)"
-                         + (": " + ", ".join(sorted(cves_now)) if cves_now else ""))
+            emit(f"{label} - first scan, establishing the baseline",
+                 f"*{label}* - first scan, establishing the baseline")
+            emit(f"  runtime: {', '.join(now['runtime']) or 'none found'}")
+            if cves_now:
+                emit(f"  {len(cves_now)} distinct CVE(s):")
+                emit_ids(cves_now)
+            else:
+                emit("  no CVEs reported")
             for note in now["drift"]:
-                lines.append(f"  runtime drift: {note}")
+                emit(f"  runtime drift: {note}")
             continue
 
         cves_before = set(before.get("cves") or [])
@@ -128,29 +155,30 @@ def main():
 
         if added or removed or rt_changed or drift_new:
             changed = True
-            lines.append(f"*{label}*")
+            emit(f"{label}", f"*{label}*")
             if added:
-                lines.append(f"  NEW: {', '.join(added)}")
+                emit(f"  NEW ({len(added)}):")
+                emit_ids(added)
             if removed:
-                lines.append(f"  gone: {', '.join(removed)}")
+                emit(f"  no longer reported ({len(removed)}):")
+                emit_ids(removed)
             if rt_changed:
-                lines.append(f"  runtime: {', '.join(rt_before) or 'none'}"
-                             f" -> {', '.join(now['runtime']) or 'none'}")
+                emit(f"  runtime: {', '.join(rt_before) or 'none'}"
+                     f" -> {', '.join(now['runtime']) or 'none'}")
             for note in drift_new:
-                lines.append(f"  runtime drift: {note}")
+                emit(f"  runtime drift: {note}")
 
-    print("\n\033[1mCompared against previous state\033[0m" if sys.stdout.isatty()
-          else "\nCompared against previous state")
+    print("\nCompared against previous state")
     if not previous:
         print("  no previous state supplied - this run establishes the baseline")
     if changed:
-        for line in lines:
-            print("  " + line.replace("*", ""))
+        for line in plain:
+            print("  " + line)
     else:
         print("  no change: same distinct CVE set, same bundled runtime")
 
     (workdir / "summary.json").write_text(json.dumps(state, indent=2, sort_keys=True))
-    (workdir / "slack.txt").write_text("\n".join(lines) if lines else "No change.")
+    (workdir / "slack.txt").write_text("\n".join(slack) if slack else "No change.")
 
     sys.exit(3 if changed else 0)
 

From eebe74d6d6de5dc85892e007f630cc4d5c0aff47 Mon Sep 17 00:00:00 2001
From: Nick Josevski <nick.josevski@octopus.com>
Date: Tue, 18 Aug 2026 17:08:44 +1000
Subject: [PATCH 5/5] Merge scan results into previous state instead of
 replacing it

A run only scans the versions it was asked for. Writing just those back dropped every
other version's baseline, so an ad-hoc 'scan the version this customer reported' run
silently wiped the scheduled baseline and the next scheduled run re-alerted from scratch
as a first scan.

Found by a real run: scanning 2025.3.417 removed the stored 2026.3.508 entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/scan-calamari-cves/compare.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/scan-calamari-cves/compare.py b/scripts/scan-calamari-cves/compare.py
index 92647a1a6..7b4f40cf9 100755
--- a/scripts/scan-calamari-cves/compare.py
+++ b/scripts/scan-calamari-cves/compare.py
@@ -177,7 +177,13 @@ def emit_ids(ids, indent="  "):
     else:
         print("  no change: same distinct CVE set, same bundled runtime")
 
-    (workdir / "summary.json").write_text(json.dumps(state, indent=2, sort_keys=True))
+    # Merge into the previous state rather than replacing it. A run only scans the versions
+    # it was asked for, so replacing would drop every other version's baseline: an ad-hoc
+    # "scan the version this customer reported" run would silently wipe the scheduled
+    # baseline, and the next scheduled run would re-alert from scratch as a first scan.
+    merged = dict(previous)
+    merged.update(state)
+    (workdir / "summary.json").write_text(json.dumps(merged, indent=2, sort_keys=True))
     (workdir / "slack.txt").write_text("\n".join(slack) if slack else "No change.")
 
     sys.exit(3 if changed else 0)