Skip to content

Add ignore-images to .grant.yaml and exclude the Serena MCP image from license scanning - #53369

Merged
pelikhan merged 9 commits into
mainfrom
copilot/container-image-scan-findings-another-one
Aug 17, 2026
Merged

Add ignore-images to .grant.yaml and exclude the Serena MCP image from license scanning#53369
pelikhan merged 9 commits into
mainfrom
copilot/container-image-scan-findings-another-one

Conversation

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

The daily container scan reports 677 license-policy violations for ghcr.io/oraios/serena:latest — 566 of them cargo crates that ship no SPDX metadata, plus 111 named-license flags from its Debian/GCC/Perl toolchain. Grant's policy schema only scopes exceptions by package name, so suppressing these would mean adding ~700 ignore-packages entries that silently weaken the allowlist for every other scanned image.

Changes

  • pkg/cli/grant.go.grant.yaml may now carry an ignore-images list of glob patterns, matched against both the tagged and pinned (@sha256:) references of each image collected from lock manifests. Matching images are skipped by gh aw compile --grant. The key is gh-aw specific; grant unmarshals its policy non-strictly, so the file remains a valid grant config.
  • .grant.yaml — excludes ghcr.io/oraios/serena:* with the rationale inline: it is a third-party development image that gh-aw executes as an MCP server and never links or redistributes.
  • CONTRIBUTING.md — documents the key next to the existing ignore-packages and .grype.yaml sections.
  • Tests / changeset — policy parsing (key present, absent, malformed), glob matching including negative cases for other registries, and a guard asserting the committed policy actually excludes the Serena image.
# .grant.yamlignore-images:
- "ghcr.io/oraios/serena:*"

Scope

Vulnerability scanning is untouched — --grype still covers this image. The 50 Critical / 128 High findings are either unfixable in the Debian trixie base (no fixed version published for perl, curl, libc6, openssh) or require serena to rebuild with patched node/tar; neither is actionable from this repository, so they stay visible rather than being risk-accepted here.


\nrun: https://github.com/github/gh-aw/actions/runs/32032749148> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 6.96 AIC · ⌖ 5.94 AIC · ⊞ 8.8K ·

Comment /souschef to run again


Generated by 👨‍🍳 PR Sous Chef · gpt54 · 18.7 AIC · ⌖ 7.77 AIC · ⊞ 8.8K ·
Comment /souschef to run again

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
CopilotAI changed the title [WIP] Fix container image scan findings for oraios/serenaAdd ignore-images to .grant.yaml and exclude the Serena MCP image from license scanningAug 17, 2026
CopilotAI requested a review from pelikhanAugust 17, 2026 12:34
@pelikhan
pelikhan marked this pull request as ready for review August 17, 2026 12:37
CopilotAI balanced review requested due to automatic review settings August 17, 2026 12:37
@github-actions

github-actionsBot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Design Decision Gate 🏗️ completed the design decision gate check.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

@github-actions

github-actionsBot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

@github-actions

github-actionsBot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Ponytail Reviewer completed successfully!

Generated by Ponytail Reviewer for #53369

@github-actions

github-actionsBot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

@github-actions

github-actionsBot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

PR Code Quality Reviewer completed the code quality review.

Reviewed PR #53369 and found no actionable blocking issues or non-duplicative line comments to submit.

🔎 Code quality review by PR Code Quality Reviewer

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds image-level license-scan exclusions while retaining vulnerability scanning.

Changes:

  • Parses and applies ignore-images glob patterns.
  • Excludes the Serena MCP image.
  • Adds documentation, tests, and a changeset.
Show a summary per file
FileDescription
pkg/cli/grant.goFilters ignored images before Grant scanning.
pkg/cli/grant_test.goTests policy parsing and matching.
.grant.yamlExcludes the Serena image.
CONTRIBUTING.mdDocuments image exclusions.
.changeset/grant-ignore-images-serena.mdRecords the user-facing change.

Review details

  • Files reviewed: 5/5 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment threadpkg/cli/grant.go Outdated
if ref == pattern {
return true
}
if matched, err := filepath.Match(pattern, ref); err == nil && matched {

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 4ca2cf3: image references now use path.Match, and TestGrantIsImageIgnored_GlobDoesNotMatchDeeperNamespace verifies a single-segment glob does not match a deeper namespace.

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The implementation is clean and correct. grantIsImageIgnored uses filepath.Match (shell globbing), which correctly handles pinned digest refs like serena:1.7.0@sha256:... since * does not cross path separators. Test coverage is thorough, including an integration test against the live .grant.yaml. No blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 12.9 AIC · ⌖ 7.89 AIC · ⊞ 5.6K

@github-actions

Copy link
Copy Markdown
Contributor

Comment Memory

reviewed_at: 2026-08-17T12:40:00Z
review_event: COMMENT
top_themes:
- no blocking issues identified
files_reviewed:
- .changeset/grant-ignore-images-serena.md
- .grant.yaml
- CONTRIBUTING.md
- pkg/cli/grant.go
- pkg/cli/grant_test.go
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 3.07 AIC · ⌖ 6.51 AIC · ⊞ 6.9K ·
Comment /review to run again

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skills-Based Review 🧠

Applied /diagnosing-bugs — approving with one minor suggestion on silent error handling.

📋 Key Themes & Highlights

Positive Highlights

  • ✅ Clean, minimal Go implementation — grantIgnoredImagePatterns + grantIsImageIgnored are well-separated and testable
  • ✅ Good test coverage: key present, absent, malformed YAML, glob matching, negative cases, and the repository policy guard test
  • ignore-images is forward-compatible — grant ignores unknown YAML keys, so the policy file remains valid
  • ✅ Verbose logging path is wired correctly; early-exit when all images are excluded is a nice touch
  • ✅ PR description clearly explains why package-level exceptions would be worse than a full image exclusion

One Finding

  • Silent bad-pattern handling — invalid glob syntax in ignore-images is swallowed silently (see inline comment). Low risk given the current single-entry policy, but worth hardening.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 21.3 AIC · ⌖ 8.53 AIC · ⊞ 7.7K
Comment /matt to run again

Comment threadpkg/cli/grant.go
}
if ref == pattern {
return true
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/diagnosing-bugs] Malformed glob patterns (e.g. [z-a]) are silently skipped — filepath.Match returns an error and the image is treated as a non-match without any warning.

💡 Suggestion

Log a warning when a pattern errors:

ifmatched, err:=filepath.Match(pattern, ref); err!=nil {
grantLog.Printf("invalid ignore-images pattern %q: %v", pattern, err)
continue
}
ifmatched {
returntrue
}

This surfaces misconfigured entries at scan time rather than silently passing an image through.

@copilot please address this.

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 4ca2cf3: invalid ignore-images patterns now emit a grant log message and are skipped; TestGrantIsImageIgnored_InvalidPattern covers the malformed-pattern path.

@github-actionsgithub-actionsBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generated by ✂️ Ponytail Reviewer for #53369 · auto · 21 AIC · ⌖ 3.61 AIC · ⊞ 7.2K
Comment /ponytail to run again

Comment threadpkg/cli/grant.go Outdated
if ref == "" {
continue
}
if ref == pattern {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

L221: delete: redundant literal-equality check before filepath.Match. filepath.Match already matches non-glob strings exactly; drop if ref == pattern { return true }.

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 4ca2cf3: removed the redundant literal-equality check; path.Match handles literal patterns exactly.

… extension
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (174 new lines in pkg/) but does not have a linked Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/53369-ignore-images-extension-for-grant-license-policy.md — review and complete it before merging.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next
  1. Review the draft ADR committed to your branch — it was generated from the PR diff
  2. Complete the missing sections — add context the AI couldn't infer, refine the decision rationale, and list real alternatives you considered
  3. Commit the finalized ADR to docs/adr/ on your branch
  4. Reference the ADR in this PR body by adding a line such as:

    ADR: ADR-53369: Extend .grant.yaml with an ignore-images Glob List

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

❓ Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

  • Context — What is the problem? What forces are at play?
  • Decision — What did you decide? Why?
  • Alternatives Considered — What else could have been done?
  • Consequences — What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number (e.g., 0042-use-postgresql.md for PR #42).

References:§32030801371

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · sonnet46 · 58.7 AIC · ⌖ 24.6 AIC · ⊞ 9K ·
Comment /review to run again

@github-actionsgithub-actionsBot mentioned this pull request Aug 17, 2026
@pelikhan

Copy link
Copy Markdown
Collaborator

@copilot run pr-finisher skill

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot this PR is ready for the next finishing pass.

Please address these items, newest first:

  • PR body / ADR follow-up remains maintainer-visible from the Design Decision Gate comment: review the drafted ADR, complete it, and link it in the PR body if still required.
  • Refresh the branch with the latest base changes if needed.
  • Run the pr-finisher skill after the fixes and summarize the remaining maintainer-visible status.

Run: https://github.com/github/gh-aw/actions/runs/32032749148

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 6.96 AIC · ⌖ 5.94 AIC · ⊞ 8.8K ·
Comment /souschef to run again

@github-actions

Copy link
Copy Markdown
Contributor

Hey @app/copilot-swe-agent 👋 — thanks for working on simplifying license policy compliance for third-party development images! This PR looks ready for review.

What this does

Adds ignore-images support to .grant.yaml to exclude container images by glob pattern from license scanning — in this case, the Serena MCP development environment that ships with 677 license-policy violations (mostly metadata gaps in Rust crates, not actual license risks). The feature maintains vulnerability scanning coverage while unblocking policy compliance.

Quality checklist ✅

  • ✅ Tests included — comprehensive coverage of policy parsing, glob pattern matching (including edge cases), and a guard assertion that the Serena image is properly excluded.
  • ✅ Focused scope — single feature with tight coupling across grant.go, tests, CONTRIBUTING.md docs, ADR, and changeset.
  • ✅ Clear rationale — PR body details the container scan findings and scopes vulnerability scanning as out-of-band.
  • ✅ Well-documented — includes an ADR for architectural context, updated CONTRIBUTING.md with the new key, and inline comments.

All green for review! 🚀

Generated by ✅ Contribution Check · auto · 45.6 AIC · ⌖ 3.1 AIC · ⊞ 9.1K ·

CopilotAIand others added 3 commits August 17, 2026 13:26
…53383)
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…ge-scan-findings-another-one
# Conflicts:
#	.github/workflows/mcp-inspector.lock.yml
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@pelikhan

Copy link
Copy Markdown
Collaborator

@copilot resolve the merge conflicts on this branch.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please take another pass on this PR. There are unresolved review threads to address:

Please respond on each open thread, refresh the branch if needed, and run the pr-finisher skill before handing back to a maintainer.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 18.7 AIC · ⌖ 7.77 AIC · ⊞ 8.8K ·
Comment /souschef to run again

CopilotAI commented Aug 17, 2026

Copy link
Copy Markdown
ContributorAuthor

@copilot please take another pass on this PR. There are unresolved review threads to address:

All three open review threads now have responses referencing 4ca2cf3. The branch already contains origin/main; final scoped validation passed. The available PR tooling does not expose a review-thread resolution operation, so the threads remain marked open for maintainer resolution.

CopilotAI requested a review from gh-aw-botAugust 17, 2026 14:06
@pelikhan
pelikhan merged commit ccf1bc8 into mainAug 17, 2026
1 check passed
@pelikhan
pelikhan deleted the copilot/container-image-scan-findings-another-one branch August 17, 2026 14:28
@github-actions

Copy link
Copy Markdown
Contributor

🎉 This pull request is included in a new release.

Release: v0.87.1

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[container-image-scan] Container findings for ghcr.io/oraios/serena:latest

4 participants

@pelikhan@gh-aw-bot