Description
The pinned scanner action invokes an installer whose download endpoint fails before any scan begins. Use the existing scanner release assets directly without weakening vulnerability enforcement or changing the selected scanner version.
Acceptance Criteria
- #1 Both Linux runner architectures install the pinned Trivy release only after checksum verification; corrupted or missing assets fail closed.
- #2 The full repository gate and guarded code review pass, and the shared release is published for consumer adoption.
- #3 The affected consumers and a consumer publication run proving the repaired installation are recorded.
Definition of Done
- #1 just check (fmt-check + lint + test + pii-check; the same gate ci.yml enforces via .github/workflows/just-check.yml)
- #2 For a change to a reusable workflow’s INPUTS or PERMISSIONS: check the callers across the fleet, not just this repo —
just callers
Implementation Plan
Add a bounded verified GitHub-release installation step for the existing scanner version, retain the scanner action with setup disabled, exercise the actual embedded shell using synthetic release assets (including corruption), verify both real architecture assets, run just check and dsreview, then publish the shared release. Consumer adoption and publication proof are handled by the coordinating session.
Implementation Notes
The candidate installs the existing 0.70.0 release directly, verifies exactly one matching checksum before extracting, and disables only the scanner action installer. The action and enforced HIGH/CRITICAL scan remain unchanged. The actual embedded shell passes both native architecture fixtures; valid altered archives, missing checksum rows and duplicate rows fail before installation. A checksum-only bypass mutation accepts the altered archive, proving the regression observes verification. Real release archives for both architectures passed downloaded release checksum verification; their ELF architecture matches and the native binary reports 0.70.0. just check passed. Guarded review is pending.
Code search returned 16 workflow callers: agent-history, cf2otel, genai-otel-bridge, grafana-cloud-agento11y-demo, grafana-cloud-org-insights, graph2otel, meraki-dashboard-exporter, opnsense2otel, paperless-ngx-dedupe, polylens2otel, rfc6035-2otel, sagemcom-f3896-py, sf2loki, synthkit, tailscale2otel and transceiver-exporter. Caller adoption is separate; agent-history publication will provide the live proof. Inputs and permissions are unchanged.
Guarded dsreview PASS (fingerprint bc19ba97cbe016479903222bb1578db6), no critical or major findings. Both minor findings addressed: corruption proof now also rejects observed execution of the altered payload (execution-before-verification mutation reproduced); generated bytecode caches are archived outside the candidate and excluded from explicit commit paths. No review rerun for these trivial corrections.
Released as v1.25.33, tag commit 2810d8986d6fdfca97d6052742063fe14fe2bc06, containing source ab6ff50477ec266923e0106e3e8c7328de227ed6. Full local gate and source CI 41735768986 passed; release PR 165 required CI 41735847827 passed before existing auto-merge. Its diff was only changelog and manifest, with source tree equality verified. The bot merge produced no push-triggered release run; existing release-please was explicitly dispatched at the verified release commit and run 41736063367 succeeded. The previously pending v1.25.32 was published without rewriting its metadata. Remaining: record the agent-history consumer publication run after adopting the new pin; do not close until actual scanner installation and enforced scan are observed.
Consumer proof verified in agent-history Release/edge run 41736699883 at 9e2890ebc6bb7c22bc3972845870dd6732016bb5, whose publish workflow pins v1.25.33 at 2810d8986d6fdfca97d6052742063fe14fe2bc06. Both Linux build jobs show the correct archive checksum OK, Trivy Version 0.70.0, an actual Wolfi and language-package scan, SARIF success and scanned-digest publication success. The failure-only enforcement step was correctly skipped because the scans passed; it was not counted as a passing execution. Manifest merge, signing, SBOM generation and full-commit tagging all succeeded. just callers also completed; inputs and permissions are unchanged, so no consumer interface migration is required. The prior remaining consumer-proof boundary is now satisfied.
Final Summary
Released verified Trivy installation in v1.25.33 without changing scanner version or vulnerability enforcement. Both real architecture assets and the embedded-shell corruption tests passed, full gate and guarded review passed, and the first adopting consumer successfully scanned and published both architectures in run 41736699883. Other consumers receive the fix when their SHA pins advance.