mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-12 23:01:41 +00:00
e64cec5add
* ci(image-scan): add Grype image scan for OS + library CVEs Builds each of the 6 Dockerfiles via a matrix and scans the resulting image with Grype (pinned v0.114.0, sha256 verified), failing on fixable HIGH or CRITICAL across both OS/apk and language packages. This catches the layer osv-scan is structurally blind to (Wolfi/apk OS packages and vendored deps like prisma's node engine), which is the structural reason the openssl CVE slipped past CI and a customer's image scanner flagged it. Skipped on fork PRs so an outside contributor cannot run arbitrary code on our hosted runner via a malicious Dockerfile RUN line. The same pattern is used by guard-fork-dependencies.yml. Grype runs as a pinned binary with a verified checksum, so there is no mutable-tag GitHub Action in the dependency chain and no vendor credentials in the scan job. The job uses read-only contents permissions and an empty top-level permissions block. * ci(image-scan): scan only Dockerfile.non_root (rootless target) All Dockerfile variants share the same wolfi base and apk set today, so a single scan of Dockerfile.non_root gives the same OS-layer coverage at one-sixth the build cost. Dockerfile.non_root is the rootless variant we ship (USER 65534), so the scan tracks the image customers actually run. Matrix-scan if the variants ever diverge. * ci: retrigger checks (proxy_pass_through_endpoint_tests flaked on prior run) |
||
|---|---|---|
| .. | ||
| codeql | ||
| ISSUE_TEMPLATE | ||
| observatory | ||
| screenshots | ||
| scripts | ||
| workflows | ||
| dependabot.yaml | ||
| deploy-on-aws.png | ||
| deploy-on-gcp.png | ||
| deploy-to-aws.png | ||
| FUNDING.yml | ||
| pull_request_template.md | ||
| template.yaml | ||
