Repository navigation
fix: allow container-size-diff bootstrap without a baseline manifest - #1577
Ron (rjaegers) with Copilot wants to merge 5 commits into
Conversation
Co-authored-by: rjaegers <45816308+rjaegers@users.noreply.github.com>
Co-authored-by: rjaegers <45816308+rjaegers@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Missing implicit :latest normalization prevents bootstrap reports for untagged baselines, while unrecognized SchemaV2Manifest.layers causes valid Docker images to fail validation.
2 open issues
What changed in this PR
This PR addresses first-image bootstrap failures in the reusable build pipeline by allowing container-size-diff to report current sizes when the baseline manifest is confirmed missing.
Changes:
- Adds bootstrap reporting without inventing previous sizes or deltas.
- Adds layer-size validation and regression cases for missing baselines and fatal failures.
- Documents bootstrap behavior and adoption through a pinned actions release.
| File | Description |
|---|---|
docs/reusable-build-system.md |
Explains first-build behavior and release adoption. |
.github/actions/container-size-diff/test/container-size-diff.test.js |
Adds bootstrap, diagnostic, and validation regression cases. |
.github/actions/container-size-diff/README.md |
Documents bootstrap reports and failure boundaries. |
.github/actions/container-size-diff/container-size-diff.js |
Adds missing-baseline handling, current-size reporting, and layer validation. |
Review effort: Balanced
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 34 | 0 | 0 | 0.23s | ||
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.35s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.44s | ||
| ✅ JSON | prettier | 55 | 13 | 0 | 0 | 2.72s | |
| ✅ JSON | v8r | 55 | 0 | 0 | 15.39s | ||
| markdownlint | 31 | 0 | 1 | 0 | 1.67s | ||
| ✅ MARKDOWN | markdown-table-formatter | 31 | 0 | 0 | 0 | 0.32s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 1.59s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 18.28s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.02s | ||
| ✅ REPOSITORY | grype | yes | no | no | 78.47s | ||
| osv-scanner | yes | 1 | 4 | 1.7s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.02s | ||
| ✅ REPOSITORY | syft | yes | no | no | 4.62s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 9.91s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.44s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 2.74s | ||
| lychee | 165 | 1 | 0 | 11.0s | |||
| ✅ YAML | prettier | 56 | 0 | 0 | 0 | 1.52s | |
| ✅ YAML | v8r | 56 | 0 | 0 | 11.91s | ||
| ✅ YAML | yamllint | 56 | 0 | 0 | 1.18s |
Detailed Issues
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........301
🔗 Unique.........205
✅ Successful.....295
⏳ Timeouts.........0
🔀 Redirected......32
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1
Errors in docs/reusable-build-system.md
[404] https://docs.github.com/en/repositories/releasing-projects-on-github/immutable-releases (at 199:168) | Rejected status code: 404 Not Found
Hint: Followed 32 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 1 error
.github/actions/generate-release-summary/README.md:67:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
⚠️ REPOSITORY / osv-scanner - 1 error
warning: Package 'minimatch@10.2.6' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'minimatch@10.2.4' is vulnerable to 'CVE-2026-118764' (also known as 'GHSA-g3hv-75wg-m249').
= CVE-2026-118764: minimatch has potential denial of service via globparts amplification
= minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess() when optimizationLevel >= 2.
researcher: Reid Downing (b1nv0id)
files:
- src/index.ts: 690-770
- src/index.ts: 780-796
issue:
input-controlled growth of globParts during first-phase preprocessing, followed by quadratic second-phase processing.
the **/../ transformation clones a globparts entry and appends the clone to the same globparts array:
parts.splice(gs, 1)
const other = parts.slice(0)
other[gs] = '**'
globParts.push(other)
this occurs inside a do...while (didSomething) fixpoint loop, allowing generated entries to be processed again.
the expanded globparts array is subsequently processed by secondPhasePreProcess(), which performs pairwise comparisons:
for (let i = 0; i < globParts.length - 1; i++) {
for (let j = i + 1; j < globParts.length; j++) {
this.partsMatch(...)
}
}
an attacker who can supply a glob pattern can therefore cause additional pattern entries to be generated during preprocessing, followed by quadratic pairwise processing, resulting in excessive cpu and memory consumption.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: Package 'bare-metal@0.2.5' is vulnerable to 'RUSTSEC-2026-0110'.
= RUSTSEC-2026-0110: bare-metal is deprecated
= The `bare-metal` crate has been deprecated and archived.
For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
warning: 4 warnings emitted
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v10.2.0 (58 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@10.2.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
There was a problem hiding this comment.
🔵 Needs a closer look
A live bootstrap run is needed because mocked inspector coverage cannot verify that real Docker/registry diagnostics are recognized and the new-image workflow proceeds through supply-chain and integration gates.
No open issues 🎉
2 resolved since last review
Review effort: Balanced
|
Copilot I don't like the check logic on the textual return strings. Can you check if there are options to use a Node library to interact with Docker instead of wrapping calls to the cli? |
I checked the options. |
First PR builds of new images fail size analysis when no
:edgebaseline exists, blocking subsequent supply-chain and integration gates. This change treats confirmed baseline absence as a bootstrap condition without suppressing other failures.actions/vX.Y.Zrelease. No workflow oredgetagging changes.