Conversation
|
@codex review |
There was a problem hiding this comment.
Pull request overview
Remediates Go module and bundled Trivy vulnerabilities while preserving scanner and e2e behavior.
Changes:
- Removes Trivy’s Go-library dependency via a local report DTO.
- Migrates ORAS v1 to v2 with legacy digest parsing compatibility.
- Upgrades dependencies, Go tooling, and builds Trivy 0.72.0 from patched pinned source.
Show a summary per file
| File | Description |
|---|---|
test/e2e/util/utils.go |
Migrates ORAS parsing while preserving legacy references. |
pkg/scanners/trivy/types.go |
Replaces Trivy report types with local DTOs. |
pkg/scanners/trivy/types_test.go |
Tests local report parsing. |
pkg/scanners/trivy/trivy.go |
Removes Trivy logger initialization. |
Makefile |
Configures source and legacy Trivy builds. |
go.sum |
Updates module checksums. |
go.mod |
Upgrades Go and dependencies. |
Dockerfile |
Builds patched Trivy from pinned source. |
build/tooling/Dockerfile |
Runs generators in the Go 1.25 environment. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 8/9 changed files
- Comments generated: 0
- Review effort level: Balanced
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
Review details
Suppressed comments (2)
go.mod:5
- The PR description says this change preserves the repository's Go 1.25 baseline and validates with Go 1.25.12, but the module now requires Go 1.26 (and the Docker/tooling/workflow changes likewise use 1.26.5/1.26). This drops the claimed Go 1.25 compatibility and means the documented validation does not cover the submitted configuration. Keep the 1.25.12 baseline throughout, or update the PR scope and rerun validation against 1.26.
go 1.26.0
toolchain go1.26.5
build/tooling/Dockerfile:4
- The PR description says the existing pinned generators are retained and their generated output is preserved, but this changes controller-gen from v0.14.0 to v0.16.4 and the PR also changes generated RBAC/CRD files. Either retain the existing generator/output as claimed, or update the PR scope and validation to explicitly cover the generator upgrade and resulting manifest changes.
# v0.16.4 is the minimum controller-gen release whose x/tools builds with Go 1.26.
RUN GOTOOLCHAIN=local GO111MODULE=on go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.16.4
- Files reviewed: 20/21 changed files
- Comments generated: 0 new
- Review effort level: Balanced
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
| # Use the upstream Trivy release image rather than rebuilding its binary with | ||
| # local dependency overrides. | ||
| ARG TRIVY_BINARY_IMG="ghcr.io/aquasecurity/trivy:0.72.0" |
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6bee101244
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| exit-code: "1" | ||
| ignore-unfixed: true | ||
| # The upstream binary remains visible in the scheduled full-image scan. | ||
| skip-files: trivy |
There was a problem hiding this comment.
Whenever the copied /trivy executable gains another fixed vulnerability, this push/PR gate will still pass because the action defines skip-files as a path-level exclusion rather than a CVE-specific waiver (pinned action input documentation). The separate Monday SARIF workflow does not set a nonzero exit-code, so it can report such findings but cannot block the vulnerable image from merging or being released; use narrowly scoped, expiring vulnerability exceptions instead of excluding the entire scanner binary.
Useful? React with 👍 / 👎.
Summary
golang.org/x/*modules to fixed releasesgo getoverrides/trivybinary; the scheduled full-image scan remains unsuppressedRoot cause
The scanner executes
/trivyas a subprocess but imported the Trivy Go module only for logger initialization and report types. That import pulled a large vulnerable dependency graph, including Docker and containerd modules. The E2E image-reference helper also directly depended on vulnerable ORAS v1 and its Docker dependency chain.The repository separately pinned an older Trivy executable and Go 1.24/1.25 across module, build, lint, and CI surfaces. The current upstream Trivy 0.72.0 release still contains dependency findings that have package-level fixes but are not yet present in an upstream release. This PR deliberately does not fork or patch Trivy's module graph, and it does not maintain a dedicated upstream ignore file.
--ignore-unfixedremains enabled; the blocking PR scan skips only the unchanged upstream/trivybinary, while scheduled SARIF scanning continues to report it.Validation
trivy fs --ignore-unfixed .: rootgo.modhas 0 findings; the existingdocs/yarn.lockfindings remain untouchedgo mod verifyandgo mod tidy: cleanGOOS=linux GOARCH=amd64 go test -exec=true ./...go test ./pkg/scanners/trivy ./test/e2e/utilGOOS=linux GOARCH=amd64 go test -exec=true -tags=e2e ./test/e2e/tests/helm_pull_secretlinux/amd64Trivy scanner build succeeds and embeds Trivy 0.72.0linux/amd64tooling-image build succeeds under Go 1.26.5/trivyand leaves the repository-owned scanner binary and OS layers clean