feat(ci): restore container image vulnerability scanning with Grype by rusackas · Pull Request #44035 · apache/superset

rusackas · 2026-09-09T00:15:35Z

SUMMARY

Container image vulnerability scanning has been dark since #38780 removed aquasecurity/trivy-action from docker.yml. That removal was the right call: both the Action and the trivy binary itself were compromised (twice), per ASF's incident report and a follow-up StepSecurity writeup — the injected code harvested /proc/*/environ and process memory for secrets, SSH keys, and cloud credentials, and exfiltrated them. No replacement was put in place, so the docker.yml:docker-build code-scanning configuration has been showing as stale/failing in the Security tab ever since (nothing has uploaded results for it in ~6 months).

This PR restores scanning with Grype (anchore/scan-action) instead of going back to Trivy: a different tool, different maintainer, no shared supply chain with the compromised project. It's already on the ASF Infra GitHub Actions allowlist (anchore/scan-action@27805bf3... / v7.4.2), so no new allowlist request is needed — asf-allowlist-check should pass as-is.

CHANGES

Added a Scan built image for vulnerabilities step (Grype, SARIF output) and an Upload vulnerability scan results to GitHub Security tab step (github/codeql-action/upload-sarif, same pin already used in codeql-analysis.yml), gated on the same condition the old Trivy step used (push to master, lean preset only).
Added security-events: write, scoped to just the docker-build job, for the SARIF upload — the same grant pattern already used in github-action-validator.yml for zizmor's scan.
fail-build: false, matching the prior Trivy config: this stays informational and doesn't gate merges on findings.

TESTING INSTRUCTIONS

action-validator .github/workflows/docker.yml passes.
zizmor .github/workflows/docker.yml reports no new findings (only 5 pre-existing, unrelated self-repository nits on other steps).
Since this only runs on push to master with build_preset == 'lean', it won't fire on this PR itself — the way to confirm it after merge is checking that a new Grype-produced analysis shows up under Security → Code scanning for the docker.yml:docker-build category.

ADDITIONAL INFORMATION

Trivy scanning was removed from the docker-build workflow in apache#38780 after both aquasecurity/trivy-action and the trivy binary itself were compromised (twice, per the ASF incident report and a follow-up StepSecurity report) to steal credentials from GitHub Secrets during CI runs. No replacement was put in place, so the built lean image hasn't had vulnerability results uploaded to the Security tab since. Adds anchore/scan-action (Grype) instead of going back to Trivy: a different tool from a different maintainer with no shared supply chain, already on the ASF Infrastructure GitHub Actions allowlist (no new approval request needed), and it produces SARIF the same way Trivy did. Scoped `security-events: write` to just the docker-build job for the SARIF upload, matching the same grant pattern already used in github-action-validator.yml for zizmor's scan. Configured as informational-only (fail-build: false), matching the prior Trivy setup -- this workflow still doesn't gate merges on scan findings. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bito-code-review · 2026-09-09T00:15:46Z

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

…igger on docker.yml changes Addresses both CodeAnt review comments on apache#44035: - docker-build is gated by the change-detector's python/frontend/docker categories, none of which classified .github/workflows/docker.yml itself. A change to only that file (like this PR) would never trigger the job, so a broken vulnerability-scan step would go unexercised until some unrelated app-code push happened to ride along with it. Added a docker.yml pattern to the "docker" category, matching how this file already carries dedicated patterns for other CI-relevant workflow files. - Added continue-on-error to both the scan and upload steps, and gated the upload on the scan actually having produced a SARIF file. fail-build: false already covers findings not failing the build; this covers the scan/upload steps themselves erroring out (a transient DB pull issue, a GitHub API hiccup) and marking master's docker-build red for something that's meant to be purely informational. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

codecov · 2026-09-09T01:30:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.89%. Comparing base (c510946) to head (f74056a).
⚠️ Report is 6 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #44035      +/-   ##
==========================================
+ Coverage   79.88%   79.89%   +0.01%     
==========================================
  Files        2915     2916       +1     
  Lines      170737   170755      +18     
  Branches    39566    39569       +3     
==========================================
+ Hits       136391   136432      +41     
+ Misses      31829    31805      -24     
- Partials     2517     2518       +1

Flag	Coverage Δ
hive	`37.62% <ø> (-0.01%)`	⬇️
mysql	`57.39% <ø> (-0.01%)`	⬇️
postgres	`57.41% <ø> (-0.01%)`	⬇️
presto	`39.53% <ø> (-0.01%)`	⬇️
python	`84.33% <ø> (+0.02%)`	⬆️
sqlite	`57.11% <ø> (-0.01%)`	⬇️
unit	`75.37% <ø> (+0.03%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bito-code-review · 2026-09-09T04:45:16Z

Code Review Agent Run #8377a0

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: e0352da..f74056a
- scripts/change_detector.py
- tests/unit_tests/scripts/change_detector_test.py
Files skipped - 1
- .github/workflows/docker.yml - Reason: Filter setting
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

…ython for CVE-2026-6100 Two independent findings from the container-image vulnerability scan restored in apache#44035 (its first real run since Trivy was removed in apache#38780): Grype self-match false positives: the built image bundles this project's own dev build as the "apache-superset" package, installed from source with version "0.0.0.dev0" instead of a real released version. Grype cannot compare that placeholder against a fixed-version threshold, so it matches every historical apache-superset GHSA ever published as still unfixed -- confirmed 61 matches locally against this exact package metadata (up to Critical severity), including GHSA-92qf-8gh3-gwcm, GHSA-rwhh-6x83-84v6, and GHSA-wh73-hpcg-v32j, all patched years ago (4.1.0, 3.0.3, and 1.4.2 respectively) and obviously not still open on current master. Added .grype.yaml excluding the paths where that self-referential package metadata lives in the image; verified locally that this drops apache-superset matches to zero while every other package's real findings are untouched. CVE-2026-6100-python: a real, currently open finding. The base image pins Python 3.11.14-slim-trixie (Dockerfile ARG PY_VER), vulnerable to a use-after-free in lzma/bz2/gzip decompressor reuse after a MemoryError; fixed in 3.11.16 (confirmed tag published on Docker Hub 2026-09-02). Bumped all three places this version is pinned in lockstep: the Dockerfile ARG default, docker-build-extra-flags.sh's override for every non-py311/py312 preset, and the pyver-override-check workflow job's assertion of the expected effective --build-arg value. Co-Authored-By: Evan Rusackas <evan@preset.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

rusackas requested review from betodealmeida, dpgaspar, eschutho, geido, hainenber, kgabryje, mistercrunch, nytai, sadpandajoe, sha174n and villebro as code owners September 9, 2026 00:15

pull-request-size Bot added the size/M label Sep 9, 2026

github-actions Bot added the github_actions Pull requests that update GitHub Actions code label Sep 9, 2026

codeant-ai-for-open-source Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread .github/workflows/docker.yml

Comment thread .github/workflows/docker.yml

github-actions Bot added the risk:ci-script PR modifies scripts that execute in CI (supply chain risk) label Sep 9, 2026

sadpandajoe approved these changes Sep 9, 2026

View reviewed changes

rusackas merged commit bc05781 into apache:master Sep 10, 2026
76 checks passed

rusackas mentioned this pull request Sep 10, 2026

chore(docker): quiet scanner self-match noise, keep OS packages current #44124

Merged

6 tasks

rusackas requested a review from sadpandajoe September 10, 2026 05:35

Navigation Menu

Repository navigation

feat(ci): restore container image vulnerability scanning with Grype - #44035

feat(ci): restore container image vulnerability scanning with Grype#44035
rusackas merged 2 commits into
apache:masterfrom
rusackas:feat/restore-container-vuln-scan-grype

rusackas commented Sep 9, 2026

Uh oh!

bito-code-review Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Sep 9, 2026 •

edited

Loading

Code Review Agent Run #8377a0

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

rusackas commented Sep 9, 2026

SUMMARY

CHANGES

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bito-code-review Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #8377a0

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bito-code-review Bot commented Sep 9, 2026 •

edited

Loading

codecov Bot commented Sep 9, 2026 •

edited

Loading

bito-code-review Bot commented Sep 9, 2026 •

edited

Loading