Keep image versions enriched by a run out of its stale finding pass - #213
Merged
Conversation
The vulnerability refresh enriched every image version with any historical container snapshot, observed image, or base relationship, while the stale pass only kept the narrower live inventory. Image versions that were enriched a few lines earlier therefore had their fresh findings resolved again in the same run and repopulated on the next one. The identifiers of the processed image versions are now passed into the stale pass and excluded from deactivation, which also protects images whose provider call failed. Refs #205
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
VulnerabilityEnrichmentService.RefreshAsyncnow collects the identifiers of the image versions it enriched and passes them intoDeactivateStaleFindingsAsync. A finding is only treated as stale when its image version is in neither the live inventory nor the processed set.LiveImageInventoryQueryServiceis unchanged.Why
The enrichment step selects image versions with a broad predicate (
ObservedImages.Any() || ContainerSnapshots.Any() || BaseRelationships.Any()), which matches any historical container snapshot. The stale pass immediately afterwards only retained the narrower live inventory — the image versions of the latest runtime-container scan run per Docker instance, plus observed images and their base images. An image version enriched at the start of a run therefore had its freshly written findings resolved again at the end of the same run and repopulated on the next one, producing a permanent resolve/re-insert cycle that surfaced as an identical count of new and resolved findings.Linked issues
Closes #205
Review notes
ProcessImageVulnerabilitiesAsyncreturns early on a provider failure without touching findings, so a provider outage no longer resolves the finding set of every image it could not scan.ResolvedByScanRunId.VulnerabilityEnrichmentServiceTestscover an enriched-but-not-live image version surviving the stale pass, a failed enrichment keeping its findings, and two consecutive refreshes over an unchanged fleet leaving every finding active without adding rows. All three fail without the service change.Follow-up work
None