[P17] Add hardening pipeline — block on HIGH/CRITICAL, auto-close vuln issues #127

New Issue

kert · 2026-03-23T18:11:15Z

kert commented

2026-03-23 18:11:15 +00:00

Goal

A new .woodpecker/harden.yml pipeline that:

Rebuilds all images with apt-get upgrade / apk upgrade
Scans with trivy --exit-code 1 (fails on HIGH/CRITICAL with fixes)
On green scan: pushes hardened images, auto-closes matching vuln issues (#114-#117)
On red scan: keeps vuln issues open, files new ones for new CVEs

Pipeline flow

trigger: manual OR weekly cron
  build-hardened-notebooks → scan → close #114 if clean
  build-hardened-zotero → scan → close #115 if clean
  build-hardened-docs → scan → close #116 if clean
  build-hardened-api → scan → close #117 if clean
  deploy hardened images

Auto-close logic

New api.diag.vuln --close mode:

Parse scan JSON
If no HIGH/CRITICAL with fixes: search for open vuln issues matching the image name, close them with comment
If vulns remain: update existing issue body with current scan results

Acceptance criteria

Hardening pipeline in .woodpecker/harden.yml
Each Dockerfile has apt-get/apk upgrade step
Trivy blocks on fixable HIGH/CRITICAL
Vuln issues auto-closed when scan is clean
Vuln issues updated when new CVEs found
Weekly cron trigger

## Goal A new `.woodpecker/harden.yml` pipeline that: 1. Rebuilds all images with `apt-get upgrade` / `apk upgrade` 2. Scans with trivy `--exit-code 1` (fails on HIGH/CRITICAL with fixes) 3. On green scan: pushes hardened images, auto-closes matching vuln issues (#114-#117) 4. On red scan: keeps vuln issues open, files new ones for new CVEs ## Pipeline flow ``` trigger: manual OR weekly cron build-hardened-notebooks → scan → close #114 if clean build-hardened-zotero → scan → close #115 if clean build-hardened-docs → scan → close #116 if clean build-hardened-api → scan → close #117 if clean deploy hardened images ``` ## Auto-close logic New `api.diag.vuln --close` mode: - Parse scan JSON - If no HIGH/CRITICAL with fixes: search for open vuln issues matching the image name, close them with comment - If vulns remain: update existing issue body with current scan results ## Acceptance criteria - [ ] Hardening pipeline in .woodpecker/harden.yml - [ ] Each Dockerfile has apt-get/apk upgrade step - [ ] Trivy blocks on fixable HIGH/CRITICAL - [ ] Vuln issues auto-closed when scan is clean - [ ] Vuln issues updated when new CVEs found - [ ] Weekly cron trigger

kert added this to the P17: Hardened Containers — auto-patch vulns via CI/CD milestone 2026-03-23 18:11:15 +00:00

kert added the quality ci labels 2026-03-23 18:11:15 +00:00

kert referenced this issue

2026-03-23 18:16:39 +00:00

P17: Hardened containers — auto-patch vulns via CI/CD #129

kert closed this issue

2026-03-23 18:21:26 +00:00

Sign in to join this conversation.