docs/SESSION-STATE.md

@@ -1,3 +1,7 @@
+## Supplemental runtime freshness (2026-10-19)
+
+Backend PR311 image scan6307 failed because db-backup reused a cached apk-upgrade layer (libexpat2.8.5-r0, fixed2.9.0-r0). Supplemental builds now use --pull --no-cache in both PR scan-only and release publishing paths. Trivy and immutable-tag guards remain unchanged. Targeted tests cover both Dockerfile forms, fresh-build flags, scan-before-push ordering and scan failure propagation. Validation pending; no release or consumer adoption yet.
+
 # Munitor session state
 
 ## JVM runtime package freshness (2026-10-19)
@@ -101,3 +105,5 @@ Runtime freshness validation: coordinating agent completed make all (lint, pack,
 
 ## Release 0.3.7 preparation (2026-10-19)
 Includes merged PR38 (filesystem Trivy findings fail CI; current Semgrep image and zero-scan/configuration failures) and PR39 (pull fresh runtime bases and bypass cached JVM package-upgrade layers). Both feature PRs passed all CircleCI gates; PR39 also passed full local make all and seven BATS tests. Publish the stable orb only from a signed v0.3.7 tag on the reviewed main merge. Website-Backend must update both orb pins and pass real image/SAST scans before rollout. No vulnerability waiver or immutable-tag overwrite is part of this release.
+
+Validation completed: focused scan tests12/12, full make all (lint, packed orb validation, script/template tests), and7BATS passed under WSL/Nix on2026-10-19. Real backend supplemental image scans remain required after stable release adoption.

docs/TODO.md

@@ -2,6 +2,8 @@
 
 ## Pending
 
+- [ ] Validate and release supplemental-image freshness fix, then adopt it in backend PR311 and verify all supplemental Trivy scans.
+
 - [ ] Release JVM runtime cache fix and adopt the stable orb in Website-Backend; verify fresh image Trivy before release.
 
 - [ ] Run PR image-scan script/template/BATS tests on Linux and verify a consumer PR with Docker/Trivy before publishing.

src/scripts/build_push_supplemental.sh

@@ -83,7 +83,8 @@ for i in $(seq 0 $((COUNT - 1))); do
 
   # Build
   echo "Building ${FULL_TAG} ..."
-  BUILD_ARGS=(-f "${DOCKERFILE}" -t "${FULL_TAG}")
+  # Refresh base images and rerun package upgrades in supplemental Dockerfiles.
+  BUILD_ARGS=(--pull --no-cache -f "${DOCKERFILE}" -t "${FULL_TAG}")
   if [[ -n "${CIRCLE_SHA1:-}" ]]; then
     BUILD_ARGS+=(--label "org.opencontainers.image.revision=${CIRCLE_SHA1}")
   fi

tests/test_docker_scan.sh

@@ -57,11 +57,11 @@ else
   fail
 fi
 
-echo -n "  TEST: push=false builds and scans every supplemental without publishing... "
+echo -n "  TEST: push=false refreshes both Dockerfile forms and scans without publishing... "
 : > "${CALL_LOG}"
 echo 'export DOCKER_ENV_TAG=develop' >> "${BASH_ENV}"
 if PUSH_IMAGES=false bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
-  [[ $(grep -c '^docker build ' "${CALL_LOG}") == 2 ]] &&
+  [[ $(grep -c '^docker build --pull --no-cache -f ' "${CALL_LOG}") == 2 ]] &&
   [[ $(grep -c '^trivy image .*--severity HIGH,CRITICAL --exit-code 1 ' "${CALL_LOG}") == 2 ]] &&
   ! grep -Eq '^docker (push|login|tag|buildx) ' "${CALL_LOG}" &&
   [[ -s "${WORK}/migrations.json" && -s "${WORK}/worker.json" ]]; then
@@ -70,11 +70,16 @@ else
   fail
 fi
 
-echo -n "  TEST: default push still publishes version and environment tags... "
+echo -n "  TEST: default push refreshes both Dockerfile forms and scans before publishing tags... "
 : > "${CALL_LOG}"
 unset PUSH_IMAGES
 if bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
-  [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]]; then
+  [[ $(grep -c '^docker build --pull --no-cache -f ' "${CALL_LOG}") == 2 ]] &&
+  [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]] &&
+  awk '
+    /^trivy image / { image=$NF; sub(/:[^:]+$/, "", image); scanned[image]=1 }
+    /^docker push / { image=$NF; sub(/:[^:]+$/, "", image); if (!scanned[image]) exit 1 }
+  ' "${CALL_LOG}"; then
   pass
 else
   fail