fix(migrations): upgrade atlas image to v1.3.2 to clear Go CVEs

[migmartri]

Summary

• Bump the pinned arigaio/atlas base image in app/controlplane/Dockerfile.migrations from v1.2.3-97b7881-canary to the v1.3.2 stable release (sha256:1e4fe2e2…), which is built with an updated Go toolchain and dependencies.
• Clears all 15 High findings previously reported against the /atlas binary in the control-plane-migrations image, covering Go stdlib (CVE-2026-56862, CVE-2026-56864, CVE-2026-56865, CVE-2026-46600, CVE-2026-39822, GO-2026-6089, GO-2026-5942, GO-2026-4970), golang.org/x/net (GO-2026-5942), golang.org/x/text (GO-2026-5970), golang.org/x/mod (GO-2026-6179, GO-2026-6180) and google.golang.org/grpc (GHSA-hrxh-6v49-42gf).
• Align the ATLAS_VERSION used to install the atlas CLI in common.mk and .github/workflows/test.yml with the same v1.3.2 release.

AI disclosure: this change was produced with the assistance of Claude Code.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[chainloop-platform]

AI Session Checks — 🟢 86% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 86%	1	✅ 0	100% AI / 0% Human	3	+6 / -6	19m33s

🟢 86% — 100% AI — ✅ All policies passing

Aug 26, 2026 21:50 UTC · 19m33s · $2.76 · 82 in / 17.9k out · claude-code 2.1.246 (claude-opus-5)

View session details ↗

Change Summary

• Updates app/controlplane/Dockerfile.migrations from Atlas v1.2.3 canary to a pinned v1.3.2 digest.
• Bumps ATLAS_VERSION to v1.3.2 in common.mk and .github/workflows/test.yml.
• Verifies the new image and CLI with grype scans, version checks, and atlas migrate validate.

AI Session Overall Score

🟢 86% — Clean remediation session; only the promised PR creation was left unfinished.

AI Session Analysis Breakdown

🟢 95% · scope-discipline

🟢 The AI proposed exactly three file changes before editing, and the recorded diff matched. · High Impact

🟢 93% · solution-quality

No notes.

🟢 90% · user-trust-signal

No notes.

🟢 88% · context-and-planning

🟢 User supplied a detailed remediation workflow before code changes began. · High Impact

🟢 86% · verification

🟢 Grype and atlas validation confirmed the upgrade cleared High findings and kept migrations valid. · High Impact

🟡 The workflow pin bump was not exercised by rerunning the CI workflow in-session. · Low Severity

🟡 72% · alignment

🟠 After user approved applying the upgrade and opening a PR, the session stopped at a signed commit with no PR creation shown. · Medium Severity

💡 When you offer to apply and open the PR, either complete both steps or restate what remains before stopping.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/controlplane/Dockerfile.migrations	+4 / -4
modified	ai	.github/workflows/test.yml	+1 / -1
modified	ai	common.mk	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-3b0034	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-3b0034	-
✅ Passed	ai-config-no-secrets	ai-coding-session-3b0034	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-3b0034	-

---

Security Checks — ✅ 4 passing

✅ github-actions-scan

Status	Policy	Messages
✅ Passed	ci-pipeline-security	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
✅ Passed	pr-user-story-linked	-

⏭️ 1 scan not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}