fix: correct aquasecurity/trivy-action tag format in CI workflows - #139
Merged
Conversation
trivy-action's tags carry a "v" prefix (v0.36.0), unlike the bare "0.29.0" originally used — GitHub Actions failed to resolve the action at all before any step ran. Bumped hadolint-action to its latest tag while in there.
hadolint DL3066 flags USER node — a non-numeric user ID isn't reliably resolvable by every host/orchestrator (e.g. Kubernetes runAsNonRoot checks read the numeric UID). node:22-alpine's "node" user is 1000:1000, confirmed locally; switched to USER 1000:1000 and re-verified the image still builds, runs, and serves /health correctly under that UID.
Trivy found two real, unrelated-to-the-app vulnerability sources in the runtime image: node:22-alpine's OS packages (libssl3/libcrypto3) lagging their latest security patch, and the npm CLI the base image bundles, which vendors its own dependency tree (tar, pacote, brace-expansion, ...) carrying several fixed-upstream CVEs. Neither matters to this app: `apk upgrade` picks up current Alpine patches regardless of what was baked into the base image tag, and npm is never invoked at runtime (CMD calls node directly) so it's just removed. Re-verified locally: image builds, runs, still serves /health and / correctly under UID 1000, hadolint clean, and a local Trivy scan (matching CI's exact flags) now exits 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #138, which merged before this fix landed on that branch — CI on
mainis currently red forprojects/cicd-best-practices-container-apps/**because of it.aquasecurity/trivy-actiontags carry avprefix (v0.36.0), unlike the bare0.29.0originally used, so GitHub Actions couldn't resolve the action at all (Unable to resolve action 'aquasecurity/trivy-action@0.29.0', unable to find version '0.29.0') before any step in thedocker-build-and-scanjob ran. Bumpedhadolint/hadolint-actionto its latest tag while in there.Confirmed the fixed tags exist:
aquasecurity/trivy-action@v0.36.0— latest releasehadolint/hadolint-action@v3.5.0— latest releaseTest plan
actionlinton both changed workflow files — zero findingsverify-cicd-best-practices-container-apps.yml) should now go green — will confirm once it runshttps://claude.ai/code/session_01DgVRQrXf1xhAHKYsV2xVAQ