[P9] Auto-open Gitea issue when trivy discovers vulnerabilities #107

New Issue

kert · 2026-03-22T16:42:35Z

kert commented

2026-03-22 16:42:35 +00:00

Goal

When trivy scans discover HIGH or CRITICAL vulnerabilities in any container image, automatically open a Gitea issue with:

Image name and tag
CVE IDs, severity, and affected packages
Fixed version (if available)
Link to the scan result in S3
Label: quality

Current state

Trivy scans run with exit_code: 0 (non-blocking) and write JSON output. The JSON contains structured vulnerability data but is only uploaded to S3 — nobody reviews it unless they check manually.

Plan

Add a report-vulns step after each scan that:
- Parses the trivy JSON output
- Filters for HIGH/CRITICAL with known fixes
- Creates a Gitea issue per image (not per CVE) with a summary table
- Skips if no actionable vulns found
Implement as uv run python -m api.diag.vuln <scan.json> module
De-duplicate: search for existing open issues with same image+CVE before creating
Auto-close when a subsequent scan shows the vuln is fixed

Issue format

Title: vuln: notebooks — 3 HIGH, 1 CRITICAL (2026-03-22)
Body:
  Image: gitea.homelab.fhirworx.io/homelab/notebooks:sha-abc123
  Pipeline: #122

  | CVE | Severity | Package | Installed | Fixed |
  |-----|----------|---------|-----------|-------|
  | CVE-2026-1234 | CRITICAL | openssl | 3.0.1 | 3.0.2 |
  ...

Acceptance criteria

api.diag.vuln module parses trivy JSON and creates issues
Issues have quality label
No duplicate issues for same image+CVE combination
Step runs after each scan in deploy.yml and rebuild-all.yml
Full test coverage for the vuln parser and issue builder

## Goal When trivy scans discover HIGH or CRITICAL vulnerabilities in any container image, automatically open a Gitea issue with: - Image name and tag - CVE IDs, severity, and affected packages - Fixed version (if available) - Link to the scan result in S3 - Label: `quality` ## Current state Trivy scans run with `exit_code: 0` (non-blocking) and write JSON output. The JSON contains structured vulnerability data but is only uploaded to S3 — nobody reviews it unless they check manually. ## Plan 1. Add a `report-vulns` step after each scan that: - Parses the trivy JSON output - Filters for HIGH/CRITICAL with known fixes - Creates a Gitea issue per image (not per CVE) with a summary table - Skips if no actionable vulns found 2. Implement as `uv run python -m api.diag.vuln <scan.json>` module 3. De-duplicate: search for existing open issues with same image+CVE before creating 4. Auto-close when a subsequent scan shows the vuln is fixed ## Issue format ``` Title: vuln: notebooks — 3 HIGH, 1 CRITICAL (2026-03-22) Body: Image: gitea.homelab.fhirworx.io/homelab/notebooks:sha-abc123 Pipeline: #122 | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-1234 | CRITICAL | openssl | 3.0.1 | 3.0.2 | ... ``` ## Acceptance criteria - [ ] `api.diag.vuln` module parses trivy JSON and creates issues - [ ] Issues have `quality` label - [ ] No duplicate issues for same image+CVE combination - [ ] Step runs after each scan in deploy.yml and rebuild-all.yml - [ ] Full test coverage for the vuln parser and issue builder

kert added this to the P9: CI/CD Unification milestone 2026-03-22 16:42:35 +00:00

kert added the ci label 2026-03-22 16:42:35 +00:00

kert referenced this issue from a commit

2026-03-22 16:50:18 +00:00

fix scan uploads, report-failure, add vuln issue reporter

kert closed this issue

2026-03-23 17:56:50 +00:00

Sign in to join this conversation.