Skip to content

fix(ci): promote publishes container scan report with correct image names

Jérôme Revillard requested to merge worktree-fix-promote-scan-report into main

Problem

Trivy scans happen on temporary image names (tmp/genie-ai-backend:mr-258-abc123). After promote, these tmp/ digests are deleted but the vulnerability report keeps orphaned findings that can never auto-resolve — 3,339 critical+high findings stuck in the database.

Solution

In the promote job, after the imagetools create, rewrite the image names in gl-container-scanning-report.json from tmp/genie-ai-NAME:tag → genie-ai-NAME:main.

Same digest (identical sha256), correct name → GitLab vulnerability report tracks persistent images. When images are rebuilt, old CVEs auto-resolve because the report shows the same image name with updated findings.

Changes

  • promote_template: add sed rewrite after skopeo delete
  • promote_template: add artifacts:reports:container_scanning to republish fixed reports
  • All promote jobs: change needs: [{ artifacts: false }] → artifacts: true (download scan artifacts for rewriting)

Regex

sed "s|tmp/${IMAGE_NAME}:[^\"() ]*|${IMAGE_NAME}:${CI_COMMIT_BRANCH:-main}|g"

Tested on real artifact from pipeline 5572 — JSON valid, image names correctly rewritten.

Merge request reports