cve-trivy-scan

name	cve-trivy-scan
description	HyperCode V2.4 Trivy CVE scanning — Phase 8 PR gate, Phase 9 hardening pattern (apt + pip pinning), weekly fleet scan, baseline of 13 HIGH (all Debian-unfixable). Use when the user says "trivy scan", "CVE check", "scan agents", "Phase 9 hardening", "build secure", "security pipeline", or wants to vet a new Dockerfile.

cve-trivy-scan

Trivy is the CVE gate. PR-blocking, weekly fleet scan, local pre-push. Baseline target: 0 CRITICAL, ≤13 HIGH (all Debian-unfixable).

Quick Scan Commands

cd "H:\HyperStation zone\HyperCode\HyperCode-V2.4"

# Scan one agent's image
make scan-agent AGENT=healer

# Build the image first if you don't have it locally yet
make scan-build AGENT=agent-x

# Scan EVERYTHING (slow — 20+ images)
make scan-all

# Build with security defaults (always --no-cache --pull)
make build-secure

If Make targets aren't defined where you expected, check the Makefile in the V2.4 root.

Baseline (never re-debate)

Severity	Count	Action
CRITICAL	0	Hard block. Never accept new CRITICALs.
HIGH	13 (all Debian-unfixable)	Accept only if upstream Debian has no patch yet.
MEDIUM/LOW	Variable	Triage on a case-by-case basis

The 13 unfixable HIGHs are typically: docker.io/runc (moby lag), libexpat1, libncursesw6, libnghttp2, libsystemd0. They have NO upstream Debian patch. Re-check quarterly.

If a scan returns >13 HIGH or any CRITICAL → regression. Bisect by service.

Phase 9 Hardening Pattern (mandatory for every new Dockerfile)

Part A — OS hardening (every runtime stage)

RUN apt-get update --allow-releaseinfo-change && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        ca-certificates curl libexpat1 openssl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

Part B — pip pinning (every Python runtime stage)

RUN pip install --upgrade --no-cache-dir \
    "pip==26.0.1" "setuptools>=80.0.0" "wheel==0.46.2" \
    "jaraco.context>=6.0.0" "jaraco.functools>=4.1.0" "jaraco.text>=4.0.0"

Why jaraco.* is pinned explicitly: Trivy flags HIGH CVEs in jaraco.* via the setuptools transitive dep. Pinning the leaf packages directly resolves it.

Part C — CI flags

--no-cache --pull on every build in .github/workflows/trivy-scan.yml and trivy-weekly.yml. Cached layers can mask vulnerabilities.

Base image standard

python:3.11-slim — NOT pinned to a patch version. CI pulls latest patch via --pull. This auto-tracks Debian's security updates.

Docker-socket agents (special case)

healer, coder, 05-devops need to talk to the host Docker socket. Use:

# Add Docker's official repo + install docker-ce-cli (NOT docker.io)
# docker.io is moby-packaged and lags behind on CVE fixes
RUN curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - && \
    echo "deb [arch=amd64] https://download.docker.com/linux/debian bookworm stable" \
        > /etc/apt/sources.list.d/docker.list && \
    apt-get update && apt-get install -y docker-ce-cli && \
    apt-get clean && rm -rf /var/lib/apt/lists/*

CI Pipeline (Phase 8)

Workflow	Trigger	Purpose
.github/workflows/trivy-scan.yml	PR	Block merges with new CRITICAL or HIGH-above-baseline
.github/workflows/trivy-weekly.yml	Mon 06:00 UTC	Re-scan the fleet to catch newly-disclosed CVEs
Pre-push hook	Local push	Quick scan before code leaves the dev machine

Adding a New Agent (CVE checklist)

When you add a new Dockerfile to agents/<name>/:

1. Use python:3.11-slim (or matching base image standard)
2. Apply Part A (OS hardening) in the runtime stage
3. Apply Part B (pip pinning) in the runtime stage
4. Build with --no-cache --pull
5. Run make scan-build AGENT=<name> locally — must show 0 CRITICAL, ≤13 HIGH
6. Add the agent to the weekly scan list if not auto-discovered
7. Open PR — Phase 8 gate runs Trivy

Triaging a New HIGH CVE

1. Is it in our 13 known-unfixable list? → accept, document
2. Is it from a Python dep? → bump that dep in requirements.txt + rebuild
3. Is it from an apt package? → check Debian security tracker (security-tracker.debian.org)
   - Debian fix exists → apt-get upgrade picks it up on next --pull
   - No Debian fix → add to known-unfixable list with date checked
4. Is it from a transitive (e.g. setuptools → jaraco.*)? → pin the leaf in Part B

Companion Skills

• phase-10-tracker — Phase 7/8/9 context
• docker-stack-ops — building/rebuilding the stack
• update-config — configuring CI / hooks if the pipeline changes

Hard Rules

• NEVER accept a new CRITICAL — it must be fixed before merge
• NEVER skip --no-cache --pull in security-critical builds
• NEVER use docker.io in docker-socket agents — docker-ce-cli only
• NEVER pin python:3.11-slim to a patch version — let CI track latest via --pull
• ALWAYS apply Parts A + B to new runtime stages — non-negotiable