Fix CVEs and add docker-scout action to CI (#304)

* Remove binutils from final image to fix CVE-2025-69649 and CVE-2025-69650

Separate build-time dependencies into a virtual package (.build-deps)
and remove them after pip install, eliminating vulnerable binutils
from the runtime image.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Move build-deps install/remove into same RUN layer as pip install

Addresses PR review feedback: installing .build-deps in one layer and
removing in another still persists binutils in earlier layers, which
layer-aware scanners flag. Now build-base is installed and removed
within a single RUN to fully eliminate CVE-2025-69649/CVE-2025-69650.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Docker Scout CVE scanning to PR CI pipeline

Extract image build into a shared build-pdp-image job and pass
the image via artifact to both pdp-tester and a new docker-scout
job. Scout scans for critical/high CVEs on pull requests and
uploads SARIF results to GitHub Code Scanning.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix CR comments

* Add checkout step to GitHub Actions workflow for tests

This update introduces a checkout step in the tests.yml workflow to ensure the code is available for subsequent steps, enhancing the CI process.

* Update GitHub Actions release workflow permissions

This commit adds write permissions for pull-requests and security-events in the release.yml workflow, enhancing the CI/CD process by allowing better integration with GitHub features.

* Update Dockerfile to remove wget installation

This commit modifies the Dockerfile by removing the installation of wget from the apk add command, streamlining the image build process.

* Enhance Docker Scout CVE scanning in GitHub Actions workflow

This commit updates the tests.yml workflow to include a new Docker Scout CVE gate step that specifically checks for high and critical vulnerabilities, while also modifying the existing CVE report step to include all severities without exiting on failure. This improves the security scanning process during CI/CD.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: omer9564

.github/workflows/release.yml

@@ -13,6 +13,10 @@ jobs:
     # Call the reusable tests workflow.
     uses: ./.github/workflows/tests.yml
     secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
+      security-events: write
 
   build-and-push-pdp:
     needs: pdp-tests

.github/workflows/tests.yml

@@ -35,7 +35,7 @@ jobs:
           pip install ".[dev]"
           pytest -s --cache-clear horizon/tests/
 
-  pdp-tester:
+  build-pdp-image:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -74,6 +74,28 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Save Docker image as artifact
+        run: docker save permitio/pdp-v2:next -o pdp-image.tar
+
+      - name: Upload Docker image artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pdp-image
+          path: pdp-image.tar
+          retention-days: 1
+
+  pdp-tester:
+    runs-on: ubuntu-latest
+    needs: build-pdp-image
+    steps:
+      - name: Download Docker image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: pdp-image
+
+      - name: Load Docker image
+        run: docker load -i pdp-image.tar
+
       # Checkout the pdp-tester repository
       - name: Checkout pdp-tester repository
         uses: actions/checkout@v4
@@ -120,6 +142,57 @@ jobs:
             echo ""
           done
 
+  docker-scout:
+    runs-on: ubuntu-latest
+    needs: build-pdp-image
+    if: github.event_name == 'pull_request'
+    permissions:
+      # required to upload the SARIF report
+      security-events: write
+      # required to download the Docker image artifact
+      contents: read
+      # required to create a pull request comment with the SARIF report
+      pull-requests: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Download Docker image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: pdp-image
+
+      - name: Load Docker image
+        run: docker load -i pdp-image.tar
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Docker Scout CVE report (all severities)
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: local://permitio/pdp-v2:next
+          exit-code: false
+          sarif-file: scout-results.sarif
+          summary: true
+
+      - name: Docker Scout CVE gate (high and critical)
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: local://permitio/pdp-v2:next
+          only-severities: critical,high
+          exit-code: true
+
+      - name: Upload SARIF report
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: scout-results.sarif
+
   rust-ci:
     name: Rust CI
     runs-on: ubuntu-latest

Dockerfile

@@ -101,13 +101,14 @@ RUN addgroup -S permit -g 1001 && \
 # Create backup directory with permissions
 RUN mkdir -p /app/backup && chmod -R 777 /app/backup
 
-# Install necessary libraries and delete SQLite in a single RUN command
-# Use cache mount for apk to speed up package downloads
+# Install runtime libraries and delete SQLite
+# Build deps (build-base, *-dev) are installed and removed in the pip install
+# layer to avoid persisting binutils CVEs (CVE-2025-69649, CVE-2025-69650)
 RUN --mount=type=cache,target=/var/cache/apk \
     ln -s /var/cache/apk /etc/apk/cache && \
     apk update && \
     apk upgrade && \
-    apk add bash build-base libffi-dev libressl-dev musl-dev zlib-dev gcompat wget && \
+    apk add bash libffi libressl gcompat && \
     apk del sqlite
 
 
@@ -139,10 +140,12 @@ USER root
 # Use cache mount for pip to speed up incremental builds
 COPY ./requirements.txt ./requirements.txt
 RUN --mount=type=cache,target=/root/.cache/pip \
+    apk add --no-cache --virtual .build-deps build-base libffi-dev libressl-dev musl-dev zlib-dev && \
     pip install --upgrade pip setuptools && \
     pip install -r requirements.txt && \
     python -m pip uninstall -y pip setuptools wheel && \
-    rm -r /usr/local/lib/python3.10/ensurepip
+    rm -r /usr/local/lib/python3.10/ensurepip && \
+    apk del .build-deps
 
 USER permit