feat: scan container images in PR pipelines #32

2026-10-13T19:18:57Z

KofTwentyTwo commented

2026-10-13 19:18:57 +00:00

(Migrated from github.com)

Summary

Today an image CVE (for example OpenSSL, AWS SDK) only fails at release time in docker_build_push. This runs the same Trivy image scan on every feature/* and hotfix/* pipeline, so it fails at PR time.

New job munitor/docker_scan (image-scan, requires build-and-test), added to pr-checks in the java-webapp, gradle-webapp, node-api and node-webapp templates:
- builds the app image the same way the release does: same generate_dockerfile / docker_build, use_repo_dockerfile respected;
- builds every supplemental image;
- scans each with Trivy 0.69.3 using the identical severity policy (--severity HIGH,CRITICAL --exit-code 1, same .trivyignore);
- stores the JSON results as artifacts;
- never pushes, logs in, guards tags or touches the CD repo.
build_push_supplemental gets a push parameter, default true, so release behavior is unchanged.
The release-candidate workflows already build and scan, so nothing is duplicated there.
Template tests, a docker_scan test, the packed generator, README and CONTRIBUTING are updated.

Test plan

orb pack/validate, ShellCheck, template wiring checks (Codex run)
CircleCI test job
End to end: a throwaway Website-Backend feature/* branch on dev:<sha> runs image-scan (results posted here)

After merge, adopting it needs an orb release (0.3.5) and an orb_version bump in Website-Backend and Website-Frontend.

🤖 Generated with Claude Code

## Summary Today an image CVE (for example OpenSSL, AWS SDK) only fails at release time in `docker_build_push`. This runs the **same** Trivy image scan on every `feature/*` and `hotfix/*` pipeline, so it fails at PR time. - **New job `munitor/docker_scan`** (`image-scan`, requires `build-and-test`), added to `pr-checks` in the java-webapp, gradle-webapp, node-api and node-webapp templates: - builds the app image the same way the release does: same `generate_dockerfile` / `docker_build`, `use_repo_dockerfile` respected; - builds every supplemental image; - scans each with Trivy 0.69.3 using the identical severity policy (`--severity HIGH,CRITICAL --exit-code 1`, same `.trivyignore`); - stores the JSON results as artifacts; - **never pushes**, logs in, guards tags or touches the CD repo. - `build_push_supplemental` gets a `push` parameter, default `true`, so release behavior is unchanged. - The release-candidate workflows already build and scan, so nothing is duplicated there. - Template tests, a docker_scan test, the packed generator, README and CONTRIBUTING are updated. ## Test plan - [x] orb pack/validate, ShellCheck, template wiring checks (Codex run) - [ ] CircleCI `test` job - [ ] End to end: a throwaway Website-Backend `feature/*` branch on `dev:<sha>` runs `image-scan` (results posted here) After merge, adopting it needs an orb release (0.3.5) and an `orb_version` bump in Website-Backend and Website-Frontend. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/Munitor#32