From 2c0db2743bd9d8721dc1e0d9eb8364da48a42232 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:24:19 -0400 Subject: [PATCH 1/2] CP-47362: Report grype findings in the CI log Makes a failing image scan say what it found. The scan action defaults to writing SARIF to a temporary file and printing nothing, so a failure reports only that findings exist at or above the threshold. The file is discarded when the runner is torn down, leaving no way to learn which package or advisory tripped the gate short of reproducing the scan locally against a private registry. Nothing in either workflow consumes the SARIF, so the format is switched to the table, which the action writes to the step log. Applied to the pull request gate and the scheduled image scan, which had the same default. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/docker-build.yml | 4 ++++ .github/workflows/scan-images.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index bee3fbd54..ca007708e 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -302,6 +302,10 @@ jobs: image: ${{ env.REGISTRY_PROD_ADDR }}/${{ env.UNTESTED_IMAGE_NAME }}:${{ steps.meta.outputs.version }} fail-build: true severity-cutoff: high + # Print findings to the log. The action otherwise defaults to + # SARIF written to a temp file nothing here reads, so a failure + # says findings exist without saying what they are. + output-format: table k8s-version-matrix-tests: # These should match the permissions in the called workflow. diff --git a/.github/workflows/scan-images.yml b/.github/workflows/scan-images.yml index 89d6d8849..6c12caf84 100644 --- a/.github/workflows/scan-images.yml +++ b/.github/workflows/scan-images.yml @@ -47,3 +47,7 @@ jobs: image: ${{ env.REGISTRY }}:${{ matrix.tag }} fail-build: true severity-cutoff: high + # Print findings to the log. The action otherwise defaults to + # SARIF written to a temp file nothing here reads, so a failure + # says findings exist without saying what they are. + output-format: table From b54949e6d2ddad9331f38a1d3944bb9536c0a626 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:37:42 -0400 Subject: [PATCH 2/2] CP-47363: Upgrade prometheus-config-reloader to v0.93.1 Brings the bundled config reloader up two minor versions, from v0.91.0, picking up upstream's own dependency work and clearing the three high-severity x/crypto findings that were blocking the image scan. This binary is built from upstream prometheus-operator source, so its dependency versions are upstream's rather than this repository's, and the build carries go get overrides for the ones upstream has not caught up on. Those overrides name exact versions, so each goes stale as new advisories land against the version it names. That had already happened: the override named x/crypto v0.53.0, which has since had three advisories filed against it, so the line written to clear findings had become the reason for them. Upgrading lets two of the three surviving overrides go. Upstream now ships x/net v0.57.0 and x/text v0.40.0, both ahead of what the old pins asked for, so keeping those would have downgraded them. Only x/crypto still needs raising. No etcd override is added. The image scan reports an etcd advisory, but that dependency reaches the image through the bundled Alloy binary rather than this one, so an override here cannot affect it. Co-Authored-By: Claude Opus 5 (1M context) --- docker/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 1334c5d69..2b1d270df 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch # prometheus-config-reloader version, built from source in the "reloader" stage. # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md). -ARG RELOADER_VERSION=v0.91.0 +ARG RELOADER_VERSION=v0.93.1 # Multi-stage Docker build with platform-specific cache optimization: # 1. base-tools: Install system packages and tools (cached per platform) @@ -90,9 +90,12 @@ WORKDIR /reloader-src RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \ https://github.com/prometheus-operator/prometheus-operator.git . -# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up. +# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354 +# and GO-2026-6355 open against it. This is an exact version and so downgrades +# as readily as it upgrades: check what upstream resolves before touching it, +# and delete it once upstream passes it rather than bumping it forever. RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ - go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 + go get golang.org/x/crypto@v0.56.0 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \