fix(ci): restore exact AI release evidence gates

scripts/scan_container_image.sh

@@ -4,68 +4,113 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
+IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
+ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"
+KEEP_ARCHIVE="${GEOINTEL_KEEP_IMAGE_ARCHIVE:-false}"
 TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
 CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
 PYTHON_CMD="${PYTHON_BIN:-python3}"
-IGNORE_FILE="$(mktemp)"
-CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
-trap 'rm -f "$IGNORE_FILE"' EXIT
+IGNORE_FILE="$CACHE_DIR/geointel-trivy-ignore.txt"
+ARCHIVE_CREATED=false
+PARTIAL_ARCHIVE=""
 
-case "$OUTPUT" in
-  /*|*..*)
-    echo "Scan output must be a repository-relative path without '..'." >&2
+cleanup() {
+  rm -f -- "$IGNORE_FILE"
+  if [ -n "$PARTIAL_ARCHIVE" ]; then
+    rm -f -- "$PARTIAL_ARCHIVE"
+  fi
+  if [ "$ARCHIVE_CREATED" = true ] && [ "$KEEP_ARCHIVE" != true ]; then
+    rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
+  fi
+}
+trap cleanup EXIT
+
+for candidate in "$OUTPUT" "$IMAGE_ARCHIVE"; do
+  case "$candidate" in
+    /*|*..*)
+      echo "Scan paths must be repository-relative and may not contain '..'." >&2
+      exit 1
+      ;;
+  esac
+done
+
+IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$TARGET_IMAGE")"
+test -n "$IMAGE_ID"
+case "$CACHE_DIR" in
+  "$ROOT"/*) CACHE_RELATIVE="${CACHE_DIR#"$ROOT/"}" ;;
+  *)
+    echo "Trivy cache must remain inside the repository workspace." >&2
     exit 1
     ;;
 esac
+case "$CACHE_RELATIVE" in
+  *..*)
+    echo "Trivy cache may not contain '..'." >&2
+    exit 1
+    ;;
+esac
+mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$ROOT/$(dirname "$IMAGE_ARCHIVE")" "$CACHE_DIR"
 
-docker image inspect "$TARGET_IMAGE" >/dev/null
-mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
-"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
-mapfile -t ignored_container_ids < <(
-  "$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
-    --print-container-ids | tr -d '\r'
-)
-ignore_args=()
-trivy_ignore_args=()
-if [ "${#ignored_container_ids[@]}" -gt 0 ]; then
-  printf '%s\n' "${ignored_container_ids[@]}" > "$IGNORE_FILE"
-  ignore_args=(-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro")
-  trivy_ignore_args=(--ignorefile "$CONTAINER_IGNORE_FILE")
+ARCHIVE_ID=""
+if [ -s "$ROOT/$ARCHIVE_ID_FILE" ]; then
+  ARCHIVE_ID="$(tr -d '[:space:]' < "$ROOT/$ARCHIVE_ID_FILE")"
 fi
+if [ ! -s "$ROOT/$IMAGE_ARCHIVE" ] || [ "$ARCHIVE_ID" != "$IMAGE_ID" ]; then
+  rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
+  PARTIAL_ARCHIVE="$ROOT/${IMAGE_ARCHIVE}.partial.$$"
+  docker save "$IMAGE_ID" --output "$PARTIAL_ARCHIVE"
+  mv "$PARTIAL_ARCHIVE" "$ROOT/$IMAGE_ARCHIVE"
+  PARTIAL_ARCHIVE=""
+  printf '%s\n' "$IMAGE_ID" > "$ROOT/$ARCHIVE_ID_FILE"
+  ARCHIVE_CREATED=true
+fi
+
+WORKDIR="/workspace"
+WORKSPACE_ARGS=(-v "$ROOT:/workspace")
+if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev/null 2>&1; then
+  WORKDIR="$ROOT"
+  WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
+fi
+CONTAINER_CACHE_DIR="$WORKDIR/$CACHE_RELATIVE"
+CONTAINER_IGNORE_FILE="$CONTAINER_CACHE_DIR/geointel-trivy-ignore.txt"
+
+"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
+"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
+  --print-container-ids | tr -d '\r' > "$IGNORE_FILE"
 
 # Keep the complete report, including vulnerabilities without an available fix.
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$ROOT:/workspace" \
-  -v "$CACHE_DIR:/root/.cache/trivy" \
+  --user 0:0 \
+  "${WORKSPACE_ARGS[@]}" \
   "$TRIVY_IMAGE" \
   image \
+  --input "$WORKDIR/$IMAGE_ARCHIVE" \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --format json \
-  --output "/workspace/$OUTPUT" \
-  "$TARGET_IMAGE"
+  --cache-dir "$CONTAINER_CACHE_DIR" \
+  --output "$WORKDIR/$OUTPUT"
 
 # Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
 # remain visible in the full report and must be reviewed before release. The
 # postgres base image's Go gosu binary remains discoverable in a lower layer,
 # but the final filesystem replaces it with the audited setpriv shell wrapper.
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$CACHE_DIR:/root/.cache/trivy" \
-  "${ignore_args[@]}" \
+  --user 0:0 \
+  "${WORKSPACE_ARGS[@]}" \
   "$TRIVY_IMAGE" \
   image \
+  --input "$WORKDIR/$IMAGE_ARCHIVE" \
   --scanners vuln \
   --timeout 20m \
   --skip-version-check \
   --ignore-unfixed \
-  "${trivy_ignore_args[@]}" \
+  --cache-dir "$CONTAINER_CACHE_DIR" \
+  --ignorefile "$CONTAINER_IGNORE_FILE" \
   --skip-files /usr/local/bin/gosu \
   --severity HIGH,CRITICAL \
-  --exit-code 1 \
-  "$TARGET_IMAGE"
+  --exit-code 1
 
 test -s "$ROOT/$OUTPUT"
-echo "Container vulnerability report written to $OUTPUT"
+echo "Container vulnerability report written to $OUTPUT for $IMAGE_ID"