From 576de90e03d5ca582b5fc43d9a679624a97b6349 Mon Sep 17 00:00:00 2001 From: James Maes Date: Mon, 19 Oct 2026 09:13:40 -0500 Subject: [PATCH 1/2] fix(build): refresh supplemental image package layers Force fresh base-image metadata and package upgrades for supplemental images while retaining enforced vulnerability scans before publication. Co-Authored-By: Codex Signed-off-by: James Maes --- docs/SESSION-STATE.md | 6 ++++++ docs/TODO.md | 2 ++ src/scripts/build_push_supplemental.sh | 3 ++- tests/test_docker_scan.sh | 13 +++++++++---- 4 files changed, 19 insertions(+), 5 deletions(-) diff --git a/docs/SESSION-STATE.md b/docs/SESSION-STATE.md index 64c8e1f..f89a40a 100644 --- a/docs/SESSION-STATE.md +++ b/docs/SESSION-STATE.md @@ -1,3 +1,7 @@ +## Supplemental runtime freshness (2026-10-19) + +Backend PR311 image scan6307 failed because db-backup reused a cached apk-upgrade layer (libexpat2.8.5-r0, fixed2.9.0-r0). Supplemental builds now use --pull --no-cache in both PR scan-only and release publishing paths. Trivy and immutable-tag guards remain unchanged. Targeted tests cover both Dockerfile forms, fresh-build flags, scan-before-push ordering and scan failure propagation. Validation pending; no release or consumer adoption yet. + # Munitor session state ## JVM runtime package freshness (2026-10-19) @@ -101,3 +105,5 @@ Runtime freshness validation: coordinating agent completed make all (lint, pack, ## Release 0.3.7 preparation (2026-10-19) Includes merged PR38 (filesystem Trivy findings fail CI; current Semgrep image and zero-scan/configuration failures) and PR39 (pull fresh runtime bases and bypass cached JVM package-upgrade layers). Both feature PRs passed all CircleCI gates; PR39 also passed full local make all and seven BATS tests. Publish the stable orb only from a signed v0.3.7 tag on the reviewed main merge. Website-Backend must update both orb pins and pass real image/SAST scans before rollout. No vulnerability waiver or immutable-tag overwrite is part of this release. + +Validation completed: focused scan tests12/12, full make all (lint, packed orb validation, script/template tests), and7BATS passed under WSL/Nix on2026-10-19. Real backend supplemental image scans remain required after stable release adoption. diff --git a/docs/TODO.md b/docs/TODO.md index 641d742..9ab64e4 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -2,6 +2,8 @@ ## Pending +- [ ] Validate and release supplemental-image freshness fix, then adopt it in backend PR311 and verify all supplemental Trivy scans. + - [ ] Release JVM runtime cache fix and adopt the stable orb in Website-Backend; verify fresh image Trivy before release. - [ ] Run PR image-scan script/template/BATS tests on Linux and verify a consumer PR with Docker/Trivy before publishing. diff --git a/src/scripts/build_push_supplemental.sh b/src/scripts/build_push_supplemental.sh index 22670ce..72c99ca 100644 --- a/src/scripts/build_push_supplemental.sh +++ b/src/scripts/build_push_supplemental.sh @@ -83,7 +83,8 @@ for i in $(seq 0 $((COUNT - 1))); do # Build echo "Building ${FULL_TAG} ..." - BUILD_ARGS=(-f "${DOCKERFILE}" -t "${FULL_TAG}") + # Refresh base images and rerun package upgrades in supplemental Dockerfiles. + BUILD_ARGS=(--pull --no-cache -f "${DOCKERFILE}" -t "${FULL_TAG}") if [[ -n "${CIRCLE_SHA1:-}" ]]; then BUILD_ARGS+=(--label "org.opencontainers.image.revision=${CIRCLE_SHA1}") fi diff --git a/tests/test_docker_scan.sh b/tests/test_docker_scan.sh index ab20f3d..fbca3cb 100644 --- a/tests/test_docker_scan.sh +++ b/tests/test_docker_scan.sh @@ -57,11 +57,11 @@ else fail fi -echo -n " TEST: push=false builds and scans every supplemental without publishing... " +echo -n " TEST: push=false refreshes both Dockerfile forms and scans without publishing... " : > "${CALL_LOG}" echo 'export DOCKER_ENV_TAG=develop' >> "${BASH_ENV}" if PUSH_IMAGES=false bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" && - [[ $(grep -c '^docker build ' "${CALL_LOG}") == 2 ]] && + [[ $(grep -c '^docker build --pull --no-cache -f ' "${CALL_LOG}") == 2 ]] && [[ $(grep -c '^trivy image .*--severity HIGH,CRITICAL --exit-code 1 ' "${CALL_LOG}") == 2 ]] && ! grep -Eq '^docker (push|login|tag|buildx) ' "${CALL_LOG}" && [[ -s "${WORK}/migrations.json" && -s "${WORK}/worker.json" ]]; then @@ -70,11 +70,16 @@ else fail fi -echo -n " TEST: default push still publishes version and environment tags... " +echo -n " TEST: default push refreshes both Dockerfile forms and scans before publishing tags... " : > "${CALL_LOG}" unset PUSH_IMAGES if bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" && - [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]]; then + [[ $(grep -c '^docker build --pull --no-cache -f ' "${CALL_LOG}") == 2 ]] && + [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]] && + awk ' + /^trivy image / { image=$NF; sub(/:[^:]+$/, "", image); scanned[image]=1 } + /^docker push / { image=$NF; sub(/:[^:]+$/, "", image); if (!scanned[image]) exit 1 } + ' "${CALL_LOG}"; then pass else fail -- 2.54.0 From f402fb834776771ec17783e048a94a9fb97f2faf Mon Sep 17 00:00:00 2001 From: James Maes Date: Mon, 19 Oct 2026 09:21:59 -0500 Subject: [PATCH 2/2] chore(release): prepare Munitor 0.3.8 Co-Authored-By: Codex Signed-off-by: James Maes --- README.md | 8 ++++---- docs/SESSION-STATE.md | 4 ++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 9d98b93..62d9d39 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ Latin: *munitor* (fortifier, protector) -- KofTwentyTwo's unified CircleCI orb f | --- | --- | | **Tier** | Internal until classified -- listed under *Awaiting classification* in the KofTwentyTwo standards [MAINTAINERS.md](https://github.com/KofTwentyTwo/standards/blob/main/MAINTAINERS.md); Product-tier requirements are being adopted | | **Standards** | Targets [KofTwentyTwo standards](https://github.com/KofTwentyTwo/standards) 1.0.0 | -| **Orb** | [`kof22/munitor`](https://circleci.com/developer/orbs/orb/kof22/munitor), latest stable `0.3.7` | +| **Orb** | [`kof22/munitor`](https://circleci.com/developer/orbs/orb/kof22/munitor), latest stable `0.3.8` | | **Security** | [SECURITY.md](SECURITY.md) | | **Contributing** | [CONTRIBUTING.md](CONTRIBUTING.md) | @@ -70,16 +70,16 @@ Munitor validates branch names and will fail on non-conforming names. Munitor is a public CircleCI orb: any CircleCI organization can use it without forking. This checklist covers what a new consumer needs, for example a Java/Maven web service. A QQQ application should also read the [QQQ adoption checklist](https://github.com/QRun-IO/qqq/blob/develop/docs/migration/adoption-checklist.adoc) (section 7 covers release tooling). -**Version.** Use `kof22/munitor@0.3.7` (or `@0.3` to float on the 0.3 line) in `.circleci/config.yml`, and the same value as `orb_version` in `.munitor.yml`. Keep the setup orb and the generated pipeline on the same line. +**Version.** Use `kof22/munitor@0.3.8` (or `@0.3` to float on the 0.3 line) in `.circleci/config.yml`, and the same value as `orb_version` in `.munitor.yml`. Keep the setup orb and the generated pipeline on the same line. ### 1. Repository files -- `.circleci/config.yml`: the setup config from [Quick Start](#quick-start), pinned to `kof22/munitor@0.3.7`. +- `.circleci/config.yml`: the setup config from [Quick Start](#quick-start), pinned to `kof22/munitor@0.3.8`. - `.munitor.yml`: pick a [pipeline type](#pipeline-types). A Java service is `java-webapp`. KofTwentyTwo's Website-Backend is a working example; a generalized version: ```yaml pipeline: java-webapp -orb_version: "0.3.7" +orb_version: "0.3.8" image_name: my-service java_version: "21" docker: diff --git a/docs/SESSION-STATE.md b/docs/SESSION-STATE.md index f89a40a..ebe63c9 100644 --- a/docs/SESSION-STATE.md +++ b/docs/SESSION-STATE.md @@ -107,3 +107,7 @@ Runtime freshness validation: coordinating agent completed make all (lint, pack, Includes merged PR38 (filesystem Trivy findings fail CI; current Semgrep image and zero-scan/configuration failures) and PR39 (pull fresh runtime bases and bypass cached JVM package-upgrade layers). Both feature PRs passed all CircleCI gates; PR39 also passed full local make all and seven BATS tests. Publish the stable orb only from a signed v0.3.7 tag on the reviewed main merge. Website-Backend must update both orb pins and pass real image/SAST scans before rollout. No vulnerability waiver or immutable-tag overwrite is part of this release. Validation completed: focused scan tests12/12, full make all (lint, packed orb validation, script/template tests), and7BATS passed under WSL/Nix on2026-10-19. Real backend supplemental image scans remain required after stable release adoption. + +## Release candidate 0.3.8 (2026-10-19) + +Promotes PR42 supplemental build freshness fix (develop11d5704) to main. Full local make all and seven BATS passed; all PR42 CI checks passed. Release metadata changes only; source/tests match the verified feature. Stable publication still requires the approved main merge and signed v0.3.8 tag. Backend adoption and real supplemental scans remain pending. -- 2.54.0