From b0dfc1ad74dfd6514fb6734fb9d96a94bbe463ec Mon Sep 17 00:00:00 2001 From: Maksim Shulga Date: Mon, 3 Aug 2026 05:26:08 +0000 Subject: [PATCH] Run the image vulnerability scan on a weekly schedule (#30) * Run the image vulnerability scan on a weekly schedule The Trivy scan added in #29 only ran against changed code (PRs and pushes), so a CVE disclosed against an otherwise unchanged base image would go unnoticed until the next actual change. Add a weekly cron trigger, matching Dependabot's cadence in .github/dependabot.yml. The push job's existing `if: github.event_name == 'push'` guard means a schedule-triggered run builds and scans but never publishes. * Add workflow_dispatch so the scan can be run on demand Copilot review on PR #30 suggested this: waiting for the Monday cron to validate a fix is unnecessary friction. workflow_dispatch has no inputs, so it just re-runs the same build/test/scan on demand; the push job's event_name guard still keeps it from publishing. --------- Co-authored-by: Maxim Shulga --- .github/workflows/docker-publish.yml | 8 ++++++++ IMPROVEMENTS.md | 10 ++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 7804326..b1c9cb9 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -9,6 +9,14 @@ on: pull_request: + # Catch newly disclosed CVEs against unchanged code; matches Dependabot's + # weekly cadence in .github/dependabot.yml. + schedule: + - cron: '0 6 * * 1' + + # Run the scan on demand instead of waiting for the next cron tick. + workflow_dispatch: + permissions: contents: read diff --git a/IMPROVEMENTS.md b/IMPROVEMENTS.md index aea6d8b..1250af4 100644 --- a/IMPROVEMENTS.md +++ b/IMPROVEMENTS.md @@ -212,10 +212,12 @@ Acceptance criteria: Dependabot configuration covers `requirements.txt`, the Dockerfile base image, and the workflow actions. The Seafile AppImage is fetched by URL and checksum, so it still has to be bumped by hand. -- [ ] Run dependency and image scans on pull requests and on a schedule. The - `test` job now runs the Trivy image scan on every pull request and on every - push to `master` or a tag (see P0), which covers new code; a scheduled run - to catch newly disclosed CVEs against unchanged code is still missing. +- [x] Run dependency and image scans on pull requests and on a schedule. The + `test` job runs the Trivy image scan on every pull request, on every push + to `master` or a tag, and now weekly (`schedule: cron '0 6 * * 1'`, + matching Dependabot's cadence) to catch newly disclosed CVEs against + unchanged code. Dependency updates themselves are Dependabot's job; see + "CI and release pipeline" above. Acceptance criteria: