From 0df3e3d4add8ffc712bdd465ceed9a22c10e751d Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 17 Sep 2026 15:46:27 +1000 Subject: [PATCH 1/3] UID2-7877 Scan all sample Docker images --- .../vulnerability-scan-failure-notify.yaml | 61 ++++++++++++++++++- 1 file changed, 60 insertions(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scan-failure-notify.yaml b/.github/workflows/vulnerability-scan-failure-notify.yaml index 6704b919..4ecd61e5 100644 --- a/.github/workflows/vulnerability-scan-failure-notify.yaml +++ b/.github/workflows/vulnerability-scan-failure-notify.yaml @@ -15,9 +15,68 @@ on: - cron: '0 0 * * *' # 5:00 PM GMT -7 jobs: - vulnerability-scan-failure-notify: + filesystem-scan-failure-notify: uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-vulnerability-scan-failure-notify.yaml@v3 secrets: SLACK_WEBHOOK : ${{ secrets.SLACK_WEBHOOK }} with: scan_type : fs + + # A filesystem scan only checks files in the repository. Build every image with the same + # Dockerfile/context pair used by release-all-docker-images.yaml so base image and installed + # runtime package vulnerabilities are also detected. + image-scan-failure-notify: + strategy: + fail-fast: false + matrix: + include: + - name: reverse-proxy + dockerfile: tools/reverse-proxy/Dockerfile + context: tools/reverse-proxy + - name: secure-signals-client-server + dockerfile: web-integrations/google-secure-signals/client-server/Dockerfile + context: web-integrations/google-secure-signals/client-server + - name: secure-signals-client-side + dockerfile: web-integrations/google-secure-signals/client-side/Dockerfile + context: web-integrations/google-secure-signals/client-side + - name: secure-signals-server-side + dockerfile: web-integrations/google-secure-signals/server-side/Dockerfile + context: web-integrations/google-secure-signals/server-side + - name: secure-signals-react-client-side + dockerfile: web-integrations/google-secure-signals/react-client-side/Dockerfile + context: web-integrations/google-secure-signals/react-client-side + - name: javascript-sdk-client-side + dockerfile: web-integrations/javascript-sdk/client-side/Dockerfile + context: web-integrations/javascript-sdk/client-side + - name: javascript-sdk-client-server + dockerfile: web-integrations/javascript-sdk/client-server/Dockerfile + context: web-integrations/javascript-sdk/client-server + - name: javascript-sdk-react-client-side + dockerfile: web-integrations/javascript-sdk/react-client-side/Dockerfile + context: web-integrations/javascript-sdk/react-client-side + - name: server-side + dockerfile: web-integrations/server-side/Dockerfile + context: web-integrations/server-side + - name: prebid-client-side + dockerfile: web-integrations/prebid-integrations/client-side/Dockerfile + context: web-integrations/prebid-integrations + - name: prebid-client-server + dockerfile: web-integrations/prebid-integrations/client-server/Dockerfile + context: web-integrations/prebid-integrations + - name: prebid-client-side-deferred + dockerfile: web-integrations/prebid-integrations/client-side-deferred/Dockerfile + context: web-integrations/prebid-integrations + - name: prebid-secure-signals-client-side + dockerfile: web-integrations/prebid-secure-signals/client-side/Dockerfile + context: web-integrations/prebid-secure-signals + - name: hashing-tool + dockerfile: tools/hashing-tool/Dockerfile + context: tools/hashing-tool + name: Image scan - ${{ matrix.name }} + uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-vulnerability-scan-failure-notify.yaml@v3 + secrets: + SLACK_WEBHOOK : ${{ secrets.SLACK_WEBHOOK }} + with: + scan_type : image + working_dir : ${{ matrix.context }} + dockerfile : ${{ matrix.dockerfile }} From 3204e2cf2e296705ff22958dc8f07513b3bddd39 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 17 Sep 2026 16:10:09 +1000 Subject: [PATCH 2/3] UID2-7877 Aggregate vulnerability scan notifications --- .../vulnerability-scan-failure-notify.yaml | 60 ++++++++++++++----- 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/.github/workflows/vulnerability-scan-failure-notify.yaml b/.github/workflows/vulnerability-scan-failure-notify.yaml index 4ecd61e5..a56f44fe 100644 --- a/.github/workflows/vulnerability-scan-failure-notify.yaml +++ b/.github/workflows/vulnerability-scan-failure-notify.yaml @@ -15,17 +15,22 @@ on: - cron: '0 0 * * *' # 5:00 PM GMT -7 jobs: - filesystem-scan-failure-notify: - uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-vulnerability-scan-failure-notify.yaml@v3 - secrets: - SLACK_WEBHOOK : ${{ secrets.SLACK_WEBHOOK }} - with: - scan_type : fs + filesystem-scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Scan repository + uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3 + with: + scan_type: fs + scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }} + failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }} + publish_vulnerabilities: 'false' # A filesystem scan only checks files in the repository. Build every image with the same # Dockerfile/context pair used by release-all-docker-images.yaml so base image and installed # runtime package vulnerabilities are also detected. - image-scan-failure-notify: + image-scan: strategy: fail-fast: false matrix: @@ -73,10 +78,37 @@ jobs: dockerfile: tools/hashing-tool/Dockerfile context: tools/hashing-tool name: Image scan - ${{ matrix.name }} - uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-vulnerability-scan-failure-notify.yaml@v3 - secrets: - SLACK_WEBHOOK : ${{ secrets.SLACK_WEBHOOK }} - with: - scan_type : image - working_dir : ${{ matrix.context }} - dockerfile : ${{ matrix.dockerfile }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Build image + uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + with: + context: ${{ matrix.context }} + file: ${{ matrix.dockerfile }} + load: true + tags: image-scan:${{ matrix.name }}-${{ github.sha }} + - name: Scan image + uses: IABTechLab/uid2-shared-actions/actions/vulnerability_scan@v3 + with: + scan_type: image + image_ref: image-scan:${{ matrix.name }}-${{ github.sha }} + scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }} + failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }} + publish_vulnerabilities: 'false' + + notify-on-failure: + name: Notify Slack on vulnerability scan failure + if: ${{ always() && (needs.filesystem-scan.result == 'failure' || needs.image-scan.result == 'failure') }} + needs: + - filesystem-scan + - image-scan + runs-on: ubuntu-latest + steps: + - name: Notify Slack + env: + SLACK_COLOR: danger + SLACK_MESSAGE: ':x: One or more vulnerability scans failed. Please review details: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}. Check past alerts before acting and log new actions to avoid duplicate efforts.' + SLACK_TITLE: Vulnerability Scan Failure + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} + uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2 From 532889f79c79fe35dd0157257bea108e77221506 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Thu, 17 Sep 2026 16:41:45 +1000 Subject: [PATCH 3/3] UID2-7877 Rely on scheduled failure summary --- .../vulnerability-scan-failure-notify.yaml | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/.github/workflows/vulnerability-scan-failure-notify.yaml b/.github/workflows/vulnerability-scan-failure-notify.yaml index a56f44fe..82d23e34 100644 --- a/.github/workflows/vulnerability-scan-failure-notify.yaml +++ b/.github/workflows/vulnerability-scan-failure-notify.yaml @@ -1,4 +1,4 @@ -name: Vulnerability Scan Failure Slack Notify +name: Vulnerability Scan on: workflow_dispatch: inputs: @@ -96,19 +96,3 @@ jobs: scan_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }} failure_severity: ${{ inputs.vulnerability_severity || 'CRITICAL,HIGH' }} publish_vulnerabilities: 'false' - - notify-on-failure: - name: Notify Slack on vulnerability scan failure - if: ${{ always() && (needs.filesystem-scan.result == 'failure' || needs.image-scan.result == 'failure') }} - needs: - - filesystem-scan - - image-scan - runs-on: ubuntu-latest - steps: - - name: Notify Slack - env: - SLACK_COLOR: danger - SLACK_MESSAGE: ':x: One or more vulnerability scans failed. Please review details: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}. Check past alerts before acting and log new actions to avoid duplicate efforts.' - SLACK_TITLE: Vulnerability Scan Failure - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2