Scan the built image for vulnerabilities and fix what's fixable (#29)

* Scan the built image for vulnerabilities and fix what's fixable

Ran trivy against the built image locally: 67 HIGH/CRITICAL findings,
65 of them in debian:bookworm-slim packages with no upstream fix yet.
The remaining 2 were both setuptools 66.1.1 (CVE-2024-6345,
CVE-2025-47273) — bundled by ensurepip when the venv is created, not
pinned by requirements.txt, so nothing was upgrading it.

- Upgrade setuptools to >=78.1.1 in the Dockerfile, which fixes both
  CVEs. Verified with a local rebuild + rescan: 0 HIGH/CRITICAL
  fixable findings remain.
- Add a Trivy scan step to the CI `test` job, after the smoke test.
  Uses --ignore-unfixed so the build fails only on findings this repo
  can act on, not on upstream Debian CVEs with no available patch.
- Check off the corresponding P0 item in IMPROVEMENTS.md; note that
  scheduled (as opposed to PR/push-triggered) scanning is still open.

* Fix trivy-action tag (needs v prefix)

* Tighten scan-coverage wording per review

Copilot review on PR #29 flagged "every pull request and push" as
ambiguous: the test job's push trigger is scoped to master and tags,
not every branch. Spell that out.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

.github/workflows/docker-publish.yml

@@ -57,6 +57,18 @@ jobs:
       - name: Container smoke test
         run: tests/smoke.sh ${{ env.IMAGE }}:ci
 
+      # ignore-unfixed: the debian:bookworm-slim base carries CVEs with no
+      # upstream fix yet; failing on those would block every build on
+      # findings nothing in this repo can act on. A fixable HIGH/CRITICAL
+      # finding still fails the build.
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: ${{ env.IMAGE }}:ci
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: '1'
+
   push:
     needs: [unit-test, test]
 

Dockerfile

@@ -52,7 +52,11 @@ RUN python3 -c "import pathlib, site; \
 # Install app requirements
 WORKDIR /dsc
 COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
+# venv creation bootstraps its own setuptools via ensurepip, which
+# requirements.txt does not cover. 66.1.1 carries CVE-2024-6345 and
+# CVE-2025-47273; 78.1.1 fixes both.
+RUN pip install --no-cache-dir --upgrade "setuptools>=78.1.1" && \
+    pip install --no-cache-dir -r requirements.txt
 
 # Copy app
 COPY dsc ./dsc/

IMPROVEMENTS.md

@@ -22,7 +22,12 @@ exploit scenarios are discussed in public issues.
   `seaf-cli` has no `--version` flag; use `seaf-cli --help` and assert the
   expected subcommands, and record the installed version from the package
   manager instead.
-- [ ] Scan the resulting image and review every high or critical finding.
+- [x] Scan the resulting image and review every high or critical finding. Of
+  67 HIGH/CRITICAL findings (`trivy image`), 65 are in `debian:bookworm-slim`
+  packages with no upstream fix yet; the CI scan uses `--ignore-unfixed` so it
+  fails only on findings this repo can act on. The other 2, both `setuptools`
+  (bundled by `ensurepip` in the venv, not from `requirements.txt`), had
+  fixes and are resolved: see `Dockerfile`.
 - [ ] Establish a stronger trust anchor for the AppImage than a self-derived
   checksum: an upstream digest or signature, or a verified artifact mirrored
   somewhere we control.
@@ -207,7 +212,10 @@ Acceptance criteria:
   Dependabot configuration covers `requirements.txt`, the Dockerfile base
   image, and the workflow actions. The Seafile AppImage is fetched by URL and
   checksum, so it still has to be bumped by hand.
-- [ ] Run dependency and image scans on pull requests and on a schedule.
+- [ ] Run dependency and image scans on pull requests and on a schedule. The
+  `test` job now runs the Trivy image scan on every pull request and on every
+  push to `master` or a tag (see P0), which covers new code; a scheduled run
+  to catch newly disclosed CVEs against unchanged code is still missing.
 
 Acceptance criteria: