1.13.0 broke our workflow, downstream auth error
Open
Nobody has claimed this yet.
upstream
- Dominant language
- JavaScript
- Stars
- 141
- Forks
- 53
- PR merge metrics
- No merged PRs in 30d
Description
1.12.0 does not have this issue
our workflow goes:
- login to ghcr.io
- login to docker hub where we have scout access
- build image
- push image to ghcr.io
- scan image
this is the error we see on 1.13.0 we are not seeing on 1.12.0
cves
...Storing image for indexing
✓ Image stored for indexing
...Indexing
✓ Indexed 412 packages
✓ Provenance obtained from attestation
Error: could not list CVEs for the image: API operation failed: Message: Not allowed, Locations: [], Extensions: map[arguments:map[context:$context query:map[imageCoords:map[digest:$digest hostname:$hostname repository:$repository] includeExcepted:$includeExcepted packageUrls:$purls]] code:DOWNSTREAM_SERVICE_ERROR status:FORBIDDEN], Path: [vulnerabilitiesByPackageForImageCoords]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the listed login, build, push, and scan workflow with versions 1.12.0 and 1.13.0, focusing on the vulnerabilitiesByPackageForImageCoords DOWNSTREAM_SERVICE_ERROR. Inspect the differences between those releases and the Docker Scout action behavior. Done means the workflow can scan the pushed image on 1.13.0 without the forbidden downstream authentication error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, javascript
- Domain
- ci-cd, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100