pkg-auto-issue-vuln: generate Gitea issue per CVE found in mirrored packages #167

New Issue

kert · 2026-03-24T03:54:38Z

kert commented

2026-03-24 03:54:38 +00:00

Goal

Scan all mirrored packages for known vulnerabilities and automatically create Gitea issues for each finding.

Scope

Use trivy (already in CI) to scan:
- apt/apk: scan container images built from local mirrors
- PyPI: trivy fs on the devpi cache or trivy sbom on lockfiles
For each CVE found, create a Gitea issue:
- Title: [pkg-vuln] {CVE-ID} in {package}@{version}
- Body: severity, affected versions, fix version if available, NIST/NVD link
- Labels: ci, quality
Deduplicate: skip if issue with same CVE+package already exists
Auto-close when fixed version is mirrored
Runs as scheduled CI job (e.g. daily) and on mirror sync

Acceptance

trivy scan of mirrored packages produces findings
Each CVE → one Gitea issue
Issues auto-close when patched version is available and mirrored

## Goal Scan all mirrored packages for known vulnerabilities and automatically create Gitea issues for each finding. ## Scope - Use trivy (already in CI) to scan: - apt/apk: scan container images built from local mirrors - PyPI: `trivy fs` on the devpi cache or `trivy sbom` on lockfiles - For each CVE found, create a Gitea issue: - Title: `[pkg-vuln] {CVE-ID} in {package}@{version}` - Body: severity, affected versions, fix version if available, NIST/NVD link - Labels: `ci`, `quality` - Deduplicate: skip if issue with same CVE+package already exists - Auto-close when fixed version is mirrored - Runs as scheduled CI job (e.g. daily) and on mirror sync ## Acceptance - [ ] trivy scan of mirrored packages produces findings - [ ] Each CVE → one Gitea issue - [ ] Issues auto-close when patched version is available and mirrored

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-03-24 03:54:38 +00:00

kert added the ci quality labels 2026-03-24 03:54:38 +00:00

kert referenced this issue

2026-03-24 03:59:01 +00:00

feat: package supply chain — inventory, mirrors, drift, vuln scanning #169

kert referenced this issue from a commit

2026-03-24 04:03:55 +00:00

add package mirrors, auto-issue scripts, network isolation test, CI workflow

kert closed this issue

2026-03-24 04:35:00 +00:00

Sign in to join this conversation.