From 48c67ba650ccebc9f501ce1bc3ee48f0ba60d0b8 Mon Sep 17 00:00:00 2001
From: Chingis S <chingis@chingis.io>
Date: Wed, 16 Sep 2026 13:47:30 +0400
Subject: [PATCH] Scan images with Docker Scout before publication

Report all CVEs and reject fixable high or critical findings before publishing the built image. Resolve scan references from the existing build settings and retain inherited-package coverage.
---
 .github/actions/scout/action.yml | 43 ++++++++++++++++++++++++++++++++
 .github/workflows/workflow.yml   | 10 ++++++++
 Makefile                         |  5 ++++
 3 files changed, 58 insertions(+)
 create mode 100644 .github/actions/scout/action.yml

diff --git a/.github/actions/scout/action.yml b/.github/actions/scout/action.yml
new file mode 100644
index 0000000..1bde6f0
--- /dev/null
+++ b/.github/actions/scout/action.yml
@@ -0,0 +1,43 @@
+name: Scan image vulnerabilities
+description: Report all CVEs and reject fixable high or critical vulnerabilities
+inputs:
+  image:
+    description: Exact local or registry image reference to scan
+    required: true
+  platform:
+    description: Platform to scan when using a registry image
+    required: false
+  only-fixed:
+    description: Limit the release gate to vulnerabilities with an available fix
+    default: 'true'
+  dockerhub-user:
+    description: Docker Hub user for Scout authentication
+    required: true
+  dockerhub-password:
+    description: Docker Hub token for Scout authentication
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Report all vulnerabilities
+      uses: docker/scout-action@v1
+      with:
+        command: cves
+        image: ${{ inputs.image }}
+        platform: ${{ inputs.platform }}
+        exit-code: false
+        write-comment: false
+        dockerhub-user: ${{ inputs.dockerhub-user }}
+        dockerhub-password: ${{ inputs.dockerhub-password }}
+    - name: Check high and critical vulnerabilities
+      uses: docker/scout-action@v1
+      with:
+        command: cves
+        image: ${{ inputs.image }}
+        platform: ${{ inputs.platform }}
+        only-severities: critical,high
+        only-fixed: ${{ inputs.only-fixed }}
+        exit-code: true
+        write-comment: false
+        dockerhub-user: ${{ inputs.dockerhub-user }}
+        dockerhub-password: ${{ inputs.dockerhub-password }}
diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
index d2759a0..ec222ed 100644
--- a/.github/workflows/workflow.yml
+++ b/.github/workflows/workflow.yml
@@ -35,6 +35,7 @@ jobs:
   build:
     needs: setup
     strategy:
+      fail-fast: false
       matrix:
         ruby: ${{ fromJson(needs.setup.outputs.ruby-versions) }}
         arch:
@@ -61,6 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Build and test
+        id: build-image
         env:
           RUBY_VER: ${{ matrix.ruby.version }}
           ARCH: ${{ matrix.arch }}
@@ -70,6 +72,14 @@ jobs:
         run: |
           make
           make test
+          echo "image=$(make --no-print-directory -s image-ref)" >> "$GITHUB_OUTPUT"
+      - name: Scan image
+        if: github.event_name == 'push'
+        uses: ./.github/actions/scout
+        with:
+          image: local://${{ steps.build-image.outputs.image }}
+          dockerhub-user: ${{ secrets.DOCKER_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}
       - uses: docker/login-action@v4
         if: github.event_name == 'push'
         with:
diff --git a/Makefile b/Makefile
index 23be189..de37a43 100644
--- a/Makefile
+++ b/Makefile
@@ -103,3 +103,8 @@ endif
 	-docker rm -f $(NAME)
 
 release: build push
+
+# Keep CI scans aligned with the version, variant and architecture built by make.
+.PHONY: image-ref
+image-ref:
+	@printf '%s\n' '$(REPO):$(TAG)'