recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

advisory-scan: count sidecar CVEs via per-image windows

Browse Source 
A recipe upgrades several images, each through its own version range. The scan
previously classified only the app repo, so sidecar bumps contributed nothing — the
alternative to the earlier bug where sidecars were judged by the APP's window and
produced a false 133.

Now: --window KEY=FROM:TO (repeatable) gives any other source its own range; each
window is classified independently (one may use patched-version ranges while another
falls back to advisory dates) and the count is the UNION. An image with no window is
still not counted — the scan will not guess a range it was not given. If ANY requested
window cannot be ordered, the total is UNKNOWN rather than a partial number.

/recipe-upgrade now instructs passing a --window per bumped sidecar.

Verified on discourse app 3.5.3->2026.7.1 + redis 7.4->8.10: 128 = 123 (app, by
publish date) + 5 (redis, by version range). The redis five are genuine for that bump
(patched 7.4.1 / 7.4.6 / 8.2.3) and include CVE-2025-49844, CRITICAL — previously
invisible. Regressions clean: gitea still 2, discourse without the sidecar window
still 123.
This commit is contained in:
autonomic-bot
2026-08-10 22:01:28 +00:00
parent 78ae2be8ae
commit b5f8543a9b
3 changed files with 133 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/skills/recipe-upgrade/SKILL.md
+8 -1
View File
@@ -163,9 +163,16 @@ Run the deterministic scanner for the exact upgrade window and **paste its markd
into the per-recipe log**:
```
python3 /srv/cc-ci/cc-ci-plan/advisory-scan.py <recipe> --from <old-app-version> --to <new-app-version>
python3 /srv/cc-ci/cc-ci-plan/advisory-scan.py <recipe> --from <old-app-version> --to <new-app-version> \
[--window <image-key>=<old>:<new> ...]
```
**Pass a `--window` for EVERY sidecar you bumped** (redis, postgres, nginx …), not just the app —
each image is judged by its own version range, and an image without a window is not counted at all.
e.g. discourse bumping app 3.5.3→2026.7.1 *and* redis 7.4→8.10:
`--from 3.5.3 --to 2026.7.1 --window redis=7.4:8.10` → 128 CVEs (123 app + 5 redis), where the redis
five include a **critical** (CVE-2025-49844) that is invisible if the sidecar is left out.
It queries, per recipe: the **GitHub Security Advisories API** for every source repo in
`cc-ci-plan/upstream/<recipe>.md` (CVE + GHSA + severity + vulnerable/patched ranges, so
"fixed by THIS upgrade" is computed, not guessed), every **vendor release/security URL** in that