feat(security): add docker security scanning workflow and documentation (#1459) by josecelano · Pull Request #1958 · torrust/torrust-tracker

josecelano · 2026-06-29T16:01:09Z

Description

Implements issue #1459 — Docker Security Overhaul: Set Up Security Scanning Workflow.

Changes

7 commits across 5 logical groups:

Group	Commits
Dictionary	`chore: add dictionary terms for security documentation`
Issue spec	`docs(issue): add issue spec for docker security overhaul (#1459)`
	`docs(issue): mark completed acceptance criteria for docker security overhaul (#1459)`
	`docs(issue): mark completed acceptance criteria for security workflow (#1459)`
Skill	`docs(skill): add maintenance skill for manual docker security scans`
Security docs	`docs(security): add manual scan docs, baseline report, and CVE catalog`
CI workflow	`ci(security): add scheduled docker security scan workflow (#1459)`

What's Included

🔒 Security Scan Workflow (`.github/workflows/security-scan.yaml`)

Daily scheduled scan (6 AM UTC) + push/PR triggers on Containerfile or workflow changes
Builds the Docker image and runs Trivy (HIGH,CRITICAL)
Table output in logs + SARIF for GitHub Code Scanning
SARIF artifact uploaded with 30-day retention
Manual dispatch support

📚 Security Documentation (`docs/security/`)

Top-level security overview with priority tiers
Docker scan instructions and scan history
Baseline scan report (Jun 29, 2026): 5 MEDIUM, 0 HIGH, 0 CRITICAL
Per-CVE analysis files for all 5 MEDIUM CVEs (all non-affecting)
CVE catalog strategy and recheck policy

🛠️ Maintenance Skill

.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md
Standardizes manual scan process (build, triage, document, escalate)

📋 Issue Spec

docs/issues/open/1459-docker-security-overhaul/ISSUE.md
Full implementation plan with 8 steps and verification plan
All 12 acceptance criteria completed

🔖 README Badge

Security scan workflow badge added to README

Verification Status

Automated checks (workflow syntax, schedule execution, Trivy output) — pending CI run
Manual verification — pending

Pull request overview

This PR introduces an automated Docker image security scanning workflow (Trivy) and a supporting documentation/collaboration structure (scan history, CVE triage catalog, and a maintenance skill) to help the project continuously track container vulnerabilities.

Changes:

Added a scheduled GitHub Actions workflow to build the container image and run Trivy scans (table + SARIF output).
Added docs/security/ documentation set: scan instructions, scan history, and per-CVE “non-affecting” analyses for the baseline findings.
Added a maintenance skill to standardize manual scans + documentation updates, plus an issue spec to track/verify the work.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`README.md`	Adds a badge link for the new security scan workflow.
`project-words.txt`	Adds spell-check dictionary terms for Trivy/security documentation.
`docs/security/README.md`	Adds top-level security overview and pointers to scan/analysis docs.
`docs/security/docker/README.md`	Adds manual scan instructions and references the automated workflow.
`docs/security/docker/scans/README.md`	Adds an index page for scan history.
`docs/security/docker/scans/torrust-tracker.md`	Adds baseline scan report + rationale for findings.
`docs/security/analysis/README.md`	Documents catalog strategy and recheck policy for vulnerability analysis.
`docs/security/analysis/non-affecting/CVE-2026-5435.md`	Per-CVE non-affecting analysis (glibc TSIG).
`docs/security/analysis/non-affecting/CVE-2026-5450.md`	Per-CVE non-affecting analysis (glibc scanf).
`docs/security/analysis/non-affecting/CVE-2026-5928.md`	Per-CVE non-affecting analysis (glibc ungetwc).
`docs/security/analysis/non-affecting/CVE-2026-6238.md`	Per-CVE non-affecting analysis (glibc DNS response).
`docs/security/analysis/non-affecting/CVE-2026-27171.md`	Per-CVE non-affecting analysis (zlib CRC32).
`docs/security/analysis/non-affecting/2026-06-10_containerfile-trixie-cves.md`	Adds/updates bulk triage record with recheck conditions.
`docs/issues/open/1459-docker-security-overhaul/ISSUE.md`	Adds the issue spec and tracks acceptance criteria for #1459.
`.github/workflows/security-scan.yaml`	Adds the scheduled/push/PR-triggered Trivy image scan workflow and SARIF generation.
`.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md`	Adds a maintenance skill documenting how to run/triage/document manual scans.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

josecelano

Fixed in commit cffbebff. Ran a case-insensitive sort on the entire file and deduplicated 5 repeated entries. The file is now in proper alphabetical order and all linters pass (including cspell).

josecelano

Fixed in commit 8036dfbc. Changed ../../ to ../../../ so the link correctly resolves from docs/security/docker/README.md to .github/workflows/security-scan.yaml at the repo root.

josecelano

This was already partially addressed when the status was changed to implementing in an earlier commit. Now updated to completed in commit 0d629c95 — all 12 acceptance criteria are checked off and the spec reflects the delivered state.

josecelano

Addressed both token permissions and SARIF upload issues in commit 3fdc1ce7.

This adds cspell dictionary terms needed by the new security docs (Docker scan, CVE catalog, Trivy, etc.). Words added include: aquasec, aquasecurity, dfsg, DNSSEC, exploitability, flate, flate2, fgetwc, fscanf, fputwc, gethostbyname, getaddrinfo, libc, libc6, miniz, miniz_oxide, nquery, sarif, scanf, sscanf, SARIF, Trixie, TSIG, trivy, trivy-action, trivy-results, ungetwc.

…verhaul (torrust#1459)

- Add docs/security/README.md — priority-tier security overview - Add docs/security/docker/README.md — scanning instructions and context - Add docs/security/docker/scans/README.md — scan history index table - Add docs/security/docker/scans/torrust-tracker.md — baseline scan report with 5 MEDIUM CVEs - Add 5 per-CVE analysis files in docs/security/analysis/non-affecting/ (glibc TSIG, scanf, ungetwc, DNS; zlib CRC32) - Update docs/security/analysis/README.md with catalog strategy and recheck policy - Update bulk triage document with requires-recheck-when frontmatter

…torrust#1459)

…1459) Updates related-pr to PR torrust#1958 and status to 'implementing'.

Runs a case-insensitive sort on project-words.txt to restore proper alphabetical ordering. Deduplicates 5 repeated entries that were present.

…orrust#1459)

…ts permission Replaces actions/upload-artifact with github/codeql-action/upload-sarif so SARIF results appear in GitHub Security > Code Scanning alerts. Adds security-events: write to job permissions (required for CodeQL upload-sarif).

… scans Increases timeout from 15 to 45 minutes (Rust compilation can exceed 25 min). Scheduled scans now pull torrust/tracker:develop from Docker Hub instead of building from source (minutes vs ~30 min). Push/PR triggers on Containerfile changes still build from source to scan the exact changed image. Updates codeql-action/upload-sarif from v3 to v4 (v3 uses deprecated Node 20).

github-advanced-security · 2026-06-29T18:01:01Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

josecelano · 2026-06-29T18:22:56Z

ACK 3ef9e32

…ssues/open to docs/issues/closed 174904d chore(ci): point to ADR instead of closed issue spec in deployment-packages.yaml (Jose Celano) 2e2178f docs(skill): document branch-already-exists edge case in cleanup-completed-issues skill (Jose Celano) 1bfd306 chore(issues): archive closed issue specs #1447, #1459, #1505, #1926, #1938, #1944, #1959, #1964, #1965, #1969 to docs/issues/closed (Jose Celano) Pull request description: Archives the following 10 issue specs that are closed on GitHub, moving them from `docs/issues/open/` to `docs/issues/closed/`: | Issue | Title | PR | |-------|-------|-----| | #1447 | Change logging threshold for connection ID error to WARNING | #1975 | | #1459 | Docker Security Overhaul | #1958 | | #1505 | Optimize peer IP list from swarm (implementation rejected) | #1949 | | #1926 | Define package versioning strategy | #1961 | | #1938 | REST API Contract-First Migration EPIC | #1960 (SI-1→5) | | #1944 | SI-6: Align REST API client | #1968 | | #1959 | SI-7: Review tests, align v1 namespace | #1963 | | #1964 | Rename number-of-downloads BTreeMap type alias | #1972 | | #1965 | SI-34: Consolidate duplicate HTTP types | #1974 | | #1969 | SI-8: Eliminate unwraps from REST API client | #1973 | ### Changes Made - All 10 specs verified `CLOSED` on GitHub with merged PRs - Files/directories moved via `git mv` to `docs/issues/closed/` - Frontmatter updated: `status: done`, `spec-path` → closed path, `last-updated-utc: 2026-07-15` - Workflow checkpoints updated and progress log entries added - Supplementary files in multi-file directories updated with new paths - Parent EPIC specs (#1669, #1938) updated: subissue status, spec paths, and table references - Fixed stale references in `.github/workflows/deployment-packages.yaml`, `docs/adrs/`, and `docs/issues/closed/` files - Pre-commit and pre-push hooks passed (linter, tests, doc-tests, nightly checks) ACKs for top commit: josecelano: ACK 174904d Tree-SHA512: c7e38354bb5898fc5125a0b68fd61a02ca273689593638eb3b955b9176038ef82c40fc98b0a2f722eb18d8d429d2f2dbb6f205eee3061211ab9906c5be46942b

Copilot AI review requested due to automatic review settings June 29, 2026 16:01

josecelano requested a review from a team as a code owner June 29, 2026 16:01

josecelano temporarily deployed to coverage June 29, 2026 16:01 — with GitHub Actions Inactive

Copilot started reviewing on behalf of josecelano June 29, 2026 16:01 View session

josecelano self-assigned this Jun 29, 2026

josecelano added a commit to josecelano/torrust-tracker that referenced this pull request Jun 29, 2026

docs(issue): update issue spec with PR reference and status (torrust#…

d48458c

…1459) Updates related-pr to PR torrust#1958 and status to 'implementing'.

josecelano temporarily deployed to coverage June 29, 2026 16:02 — with GitHub Actions Inactive

Copilot AI reviewed Jun 29, 2026

View reviewed changes

Comment thread project-words.txt Outdated

Comment thread docs/security/docker/README.md Outdated

Comment thread docs/issues/open/1459-docker-security-overhaul/ISSUE.md Outdated

Comment thread .github/workflows/security-scan.yaml

Comment thread .github/workflows/security-scan.yaml Outdated

josecelano temporarily deployed to coverage June 29, 2026 16:26 — with GitHub Actions Inactive

josecelano commented Jun 29, 2026

View reviewed changes

josecelano temporarily deployed to coverage June 29, 2026 16:37 — with GitHub Actions Inactive

josecelano commented Jun 29, 2026

View reviewed changes

josecelano temporarily deployed to coverage June 29, 2026 16:39 — with GitHub Actions Inactive

josecelano commented Jun 29, 2026

View reviewed changes

josecelano temporarily deployed to coverage June 29, 2026 16:45 — with GitHub Actions Inactive

josecelano commented Jun 29, 2026

View reviewed changes

josecelano temporarily deployed to coverage June 29, 2026 17:41 — with GitHub Actions Inactive

josecelano added 13 commits June 29, 2026 18:45

docs(issue): add issue spec for docker security overhaul (torrust#1459)

aadf1bc

docs(skill): add maintenance skill for manual docker security scans

db7e701

docs(issue): mark completed acceptance criteria for docker security o…

8076ea2

…verhaul (torrust#1459)

docs(issue): mark completed acceptance criteria for security workflow (…

f846218

…torrust#1459)

ci(security): add scheduled docker security scan workflow (torrust#1459)

f598e14

docs(issue): update issue spec with PR reference and status (torrust#…

0e02ee2

…1459) Updates related-pr to PR torrust#1958 and status to 'implementing'.

chore: fix alphabetical sort in cspell dictionary

19b0d9b

Runs a case-insensitive sort on project-words.txt to restore proper alphabetical ordering. Deduplicates 5 repeated entries that were present.

docs(security): fix relative link to workflow file from docker scan docs

291a0ed

docs(issue): update status to completed for docker security overhaul (t…

2975af4

…orrust#1459)

josecelano force-pushed the 1459-docker-security-overhaul branch from 4cccc23 to 3ef9e32 Compare June 29, 2026 17:46

josecelano temporarily deployed to coverage June 29, 2026 17:46 — with GitHub Actions Inactive

josecelano merged commit 91113ac into torrust:develop Jun 29, 2026
18 checks passed

josecelano mentioned this pull request Jul 15, 2026

chore(issues): archive 10 closed issue specs from docs/issues/open to docs/issues/closed #1984

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(security): add docker security scanning workflow and documentation (#1459) - #1958

feat(security): add docker security scanning workflow and documentation (#1459)#1958
josecelano merged 13 commits into
torrust:developfrom
josecelano:1459-docker-security-overhaul

josecelano commented Jun 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

josecelano left a comment

Uh oh!

josecelano left a comment

Uh oh!

josecelano left a comment

Uh oh!

josecelano left a comment

Uh oh!

github-advanced-security AI commented Jun 29, 2026

Uh oh!

josecelano commented Jun 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

josecelano commented Jun 29, 2026

Description

Changes

What's Included

🔒 Security Scan Workflow (.github/workflows/security-scan.yaml)

📚 Security Documentation (docs/security/)

🛠️ Maintenance Skill

📋 Issue Spec

🔖 README Badge

Verification Status

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

josecelano left a comment

Choose a reason for hiding this comment

Uh oh!

josecelano left a comment

Choose a reason for hiding this comment

Uh oh!

josecelano left a comment

Choose a reason for hiding this comment

Uh oh!

josecelano left a comment

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI commented Jun 29, 2026

What Enabling Code Scanning Means:

Uh oh!

josecelano commented Jun 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

🔒 Security Scan Workflow (`.github/workflows/security-scan.yaml`)

📚 Security Documentation (`docs/security/`)