[Alex-Welsh]

This PR replaces Trivy with Syft & Grype in our image build pipeline.

It also contains a set of images that built cleanly without any critical CVEs. That included bumping all repos, and actually fixing some templating issues in our pulp config (see also #2691 for another change that is included in here)

I made a lot of tweaks to try and improve runtime, it's not too bad, about 1h20s-1h40s, but it's still slower than Trivy was.

SBOMs are also larger. Again, I've tried to trim them a lot. They use a custom format which helps the golang images in particular.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: stackhpc/stackhpc-kayobe-config
• Branch: replace-trivy-v2
• File: .coderabbit.yaml
• Commit: d72f3b7
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 78d5358a-9109-41e1-836d-1197a9c040e7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

The change replaces Trivy with Grype and Syft for container image scans, adds configurable parallel scans, and updates vulnerability allowlists. It also updates Pulp repository version references and changes Kolla image tags and the Prometheus libvirt exporter source pin.

Changes: Image vulnerability scanning

Layer / File(s)	Summary
Scanner setup and documented inputs .github/workflows/stackhpc-container-image-build.yml, tools/scan-images.sh, doc/source/contributor/testing-ci-automation.rst	The workflow installs pinned Grype and Syft versions. The script configures Grype and Syft, checks for the tools, and sets scan parallelism to four by default. The documentation describes direct image scans and the optional Syft SBOM path.
Image scanning and result handling tools/scan-images.sh, etc/kayobe/grype/allowed-vulnerabilities.yml	The script sorts images by size, generates Grype ignore configuration, optionally generates SBOMs, and processes scan results. The allowlist adds global and image-specific vulnerability entries.
Database preparation and parallel execution tools/scan-images.sh, .github/workflows/stackhpc-container-image-build.yml	The script updates the Grype database and runs scans in parallel. It records failures and stops starting scans after a failure. The workflow waits for its background database update before scanning.

Pulp repository version references

Layer / File(s)	Summary
Repository version pins etc/kayobe/pulp-repo-versions.yml	Repository timestamps are updated. Grafana and OpenSearch use unified version keys, and the Fluentd and ProxySQL keys are updated.
Repository URL and suite configuration etc/kayobe/pulp.yml, etc/kayobe/kolla/repos.yaml	Pulp URLs use the updated version variables. The Grafana repository uses suite stable and component main.
Environment repository mappings etc/kayobe/environments/aio/release-train.yml, etc/kayobe/environments/ci-builder/stackhpc-ci.yml, etc/kayobe/environments/ci-multinode/stackhpc-ci.yml	The AIO, CI builder, and CI multinode settings reference updated Pulp version variables.

Kolla image inputs

Layer / File(s)	Summary
Image tags and exporter source pin etc/kayobe/kolla-image-tags.yml, etc/kayobe/kolla.yml, releasenotes/notes/full-rebuild-3c545359275d8fdc.yaml	The OpenStack image tags change for Rocky 10 and Ubuntu Noble. Kolla pins prometheus-libvirt-exporter to version 2.6.1 with architecture-specific checksums. The release note records the rebuild and exporter upgrade.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as Build workflow
  participant Script as scan-images.sh
  participant Syft
  participant Grype
  Workflow->>Script: Run image scans after database update
  Script->>Grype: Update vulnerability database
  alt SBOM input is true
    Script->>Syft: Generate JSON SBOM for image
    Syft-->>Script: Return SBOM
    Script->>Grype: Scan SBOM
  else SBOM input is false
    Script->>Grype: Scan image
  end
  Grype-->>Script: Return scan results

Loading

Merge Risk: 🟡 Moderate · up to 013c3

AIO and CI-multinode builds can use moving Fluentd and Grafana repositories instead of the intended snapshots. Add the missing mappings before merging.

Pre-merge checks: 3

Check name	Status	Explanation
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 1 files. (12 skipped: …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 1 files. (12 skipped: 12 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Alex-Welsh]

Here is the build for this set of images https://github.com/stackhpc/stackhpc-kayobe-config/actions/runs/38931400535

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository: stackhpc/stackhpc-kayobe-config/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 764edf06-a6de-42fb-8f6c-62b5f1c402e2

📥 Commits

Reviewing files that changed from the base of the PR and between fe4e839 and 013c3e3.

📒 Files selected for processing: 13

• .github/workflows/stackhpc-container-image-build.yml
• doc/source/contributor/testing-ci-automation.rst
• etc/kayobe/environments/aio/release-train.yml
• etc/kayobe/environments/ci-builder/stackhpc-ci.yml
• etc/kayobe/environments/ci-multinode/stackhpc-ci.yml
• etc/kayobe/grype/allowed-vulnerabilities.yml
• etc/kayobe/kolla-image-tags.yml
• etc/kayobe/kolla.yml
• etc/kayobe/kolla/repos.yaml
• etc/kayobe/pulp-repo-versions.yml
• etc/kayobe/pulp.yml
• releasenotes/notes/full-rebuild-3c545359275d8fdc.yaml
• tools/scan-images.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[Alex-Welsh]

Rebased to include recently rebuilt containers