rusackas opened a new pull request, #44035: URL: https://github.com/apache/superset/pull/44035
### SUMMARY Container image vulnerability scanning has been dark since [#38780](https://github.com/apache/superset/pull/38780) removed `aquasecurity/trivy-action` from `docker.yml`. That removal was the right call: both the Action and the `trivy` binary itself were compromised (twice), per [ASF's incident report](https://news.apache.org/foundation/entry/initial-report-on-trivy-security-incident) and a follow-up [StepSecurity writeup](https://www.stepsecurity.io/blog/trivy-compromised-a-second-time---malicious-v0-69-4-release) — the injected code harvested `/proc/*/environ` and process memory for secrets, SSH keys, and cloud credentials, and exfiltrated them. No replacement was put in place, so the `docker.yml:docker-build` code-scanning configuration has been showing as stale/failing in the Security tab ever since (nothing has uploaded results for it in ~6 months). This PR restores scanning with **Grype** (`anchore/scan-action`) instead of going back to Trivy: a different tool, different maintainer, no shared supply chain with the compromised project. It's already on the [ASF Infra GitHub Actions allowlist](https://github.com/apache/infrastructure-actions/blob/main/actions.yml) (`anchore/scan-action@27805bf3...` / `v7.4.2`), so no new allowlist request is needed — `asf-allowlist-check` should pass as-is. ### CHANGES - Added a `Scan built image for vulnerabilities` step (Grype, SARIF output) and an `Upload vulnerability scan results to GitHub Security tab` step (`github/codeql-action/upload-sarif`, same pin already used in `codeql-analysis.yml`), gated on the same condition the old Trivy step used (`push` to `master`, `lean` preset only). - Added `security-events: write`, scoped to just the `docker-build` job, for the SARIF upload — the same grant pattern already used in `github-action-validator.yml` for zizmor's scan. - `fail-build: false`, matching the prior Trivy config: this stays informational and doesn't gate merges on findings. ### TESTING INSTRUCTIONS - `action-validator .github/workflows/docker.yml` passes. - `zizmor .github/workflows/docker.yml` reports no new findings (only 5 pre-existing, unrelated `self-repository` nits on other steps). - Since this only runs on `push` to `master` with `build_preset == 'lean'`, it won't fire on this PR itself — the way to confirm it after merge is checking that a new Grype-produced analysis shows up under Security → Code scanning for the `docker.yml:docker-build` category. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
