feat: pre-deploy scan visibility and pinned scanner version (#1378)

* feat: pre-deploy scan visibility and pinned scanner version

Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a
manual deploy can surface each image's latest scan before it runs.

- Managed Trivy now installs a pinned, known-good version by default for
  reproducible installs. Auto-update still tracks the latest release, and an
  explicit update always pulls the latest.
- Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from
  the editor first shows each image's latest cached scan severity for review.
  It is visibility only and never blocks; deploy enforcement is unchanged.
- Backend: pre_deploy_scan_advisory setting, PUT
  /security/pre-deploy-scan-advisory, a cache-only GET
  /security/stacks/:name/pre-deploy-summary, and a node-scoped
  getLatestVulnScanByDigestForNode lookup.
- Frontend: advisory toggle on the Security page scanner setup, and a
  PreDeployScanDialog wired into the editor deploy flow that fails open when the
  summary is unavailable.
- Docs: scanner configuration, version pinning, and the advisory.

* fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state

Addresses review findings on the pre-deploy advisory.

- Block a second editor deploy during the async advisory window with a
  synchronous pending ref, cleared on cancel and in the deploy's finally, so a
  double-click can no longer start two deploys.
- Keep the pre-deploy advisory toggle visible to admins whenever the setting is
  on, so it can still be turned off after the scanner becomes unavailable.
- Resolve the managed Trivy version inside the install lock so the busy state and
  serialization cover the latest-version fetch and the managed-install check.

backend/src/services/DatabaseService.ts

@@ -588,6 +588,13 @@ export interface VulnerabilityScan {
     policy_evaluation: string | null;
 }
 
+// Fail-closed allowlist of the scanners_used values that ran the vulnerability
+// scanner. Image scans store vuln/secret joins from normalizeScanners (TrivyService),
+// while compose scans store 'config' directly; listing only the vuln-bearing sets
+// means any other value (secret-only, config, or a future literal) is excluded, so
+// a clean vuln read can never be a secret-only or config scan in disguise.
+export const VULN_BEARING_SCANNER_SETS = ['vuln', 'vuln,secret'] as const;
+
 export function parsePolicyEvaluation(raw: string | null | undefined): PolicyEvaluation | null {
     if (!raw) return null;
     try {
@@ -1458,6 +1465,7 @@ export class DatabaseService {
         stmt.run('trivy_auto_update', '0');
         stmt.run('trivy_last_notified_version', '');
         stmt.run('deploy_block_honor_suppressions', '0');
+        stmt.run('pre_deploy_scan_advisory', '0');
         stmt.run('mesh_auto_recreate', '0');
         stmt.run('prune_on_update', '1');
         stmt.run('reclaim_hero', '1');
@@ -4226,6 +4234,26 @@ export class DatabaseService {
         );
     }
 
+    /**
+     * Latest completed vulnerability-bearing scan for a digest ON A SPECIFIC NODE.
+     *
+     * Unlike getLatestScanByDigest, this filters by node_id so a read-only
+     * response never surfaces a scan (or scan id) produced on another node, and
+     * it restricts to scanner sets that actually ran the vulnerability scanner so
+     * a secret-only or config scan is not mistaken for a clean vuln scan.
+     */
+    public getLatestVulnScanByDigestForNode(digest: string, nodeId: number): VulnerabilityScan | null {
+        if (!digest) return null;
+        const placeholders = VULN_BEARING_SCANNER_SETS.map(() => '?').join(', ');
+        return (
+            (this.db
+                .prepare(
+                    `SELECT * FROM vulnerability_scans WHERE image_digest = ? AND node_id = ? AND status = 'completed' AND scanners_used IN (${placeholders}) ORDER BY scanned_at DESC LIMIT 1`,
+                )
+                .get(digest, nodeId, ...VULN_BEARING_SCANNER_SETS) as VulnerabilityScan | undefined) ?? null
+        );
+    }
+
     public deleteOldScans(olderThanMs: number): number {
         const cutoff = Date.now() - olderThanMs;
         const result = this.db

backend/src/services/TrivyInstaller.ts

@@ -4,6 +4,7 @@ import fs from 'fs';
 import path from 'path';
 import crypto from 'crypto';
 import semver from 'semver';
+import { DatabaseService } from './DatabaseService';
 
 const execFileAsync = promisify(execFile);
 
@@ -15,6 +16,11 @@ const GITHUB_API_TIMEOUT_MS = 15 * 1000;
 const VERIFY_TIMEOUT_MS = 10 * 1000;
 const LATEST_VERSION_TTL_MS = 60 * 60 * 1000;
 const MIN_TRIVY_VERSION = '0.50.0';
+// Managed installs pin to a known-good release by default so the scanner binary
+// is reproducible and supply-chain stable rather than whatever "latest" resolves
+// to at install time. Opting into auto-update (trivy_auto_update) tracks the
+// newest release instead. Keep this at or above MIN_TRIVY_VERSION.
+const PINNED_TRIVY_VERSION = '0.70.0';
 
 export type TrivySource = 'managed' | 'host' | 'none';
 
@@ -142,14 +148,28 @@ class TrivyInstaller {
     }
 
     public async install(): Promise<{ version: string }> {
-        return this.acquire(async () => this.doInstall());
+        // Resolve the version inside acquire() so busy stays true through the
+        // latest-version network fetch and a concurrent op is serialized.
+        return this.acquire(async () => this.doInstall(await this.resolveInstallVersion()));
     }
 
     public async update(): Promise<{ version: string }> {
-        if (!this.isManagedInstalled()) {
-            throw new Error('No managed Trivy install to update');
-        }
-        return this.acquire(async () => this.doInstall());
+        return this.acquire(async () => {
+            if (!this.isManagedInstalled()) {
+                throw new Error('No managed Trivy install to update');
+            }
+            // An explicit update always pulls the newest release, regardless of
+            // the auto-update setting; that is the whole point of the action.
+            return this.doInstall(await this.fetchLatestVersion(true));
+        });
+    }
+
+    // Fresh installs pin by default for reproducibility; when the operator has
+    // opted into auto-update, a fresh install tracks the latest release so it
+    // matches the cadence the scheduler will keep it on.
+    private async resolveInstallVersion(): Promise<string> {
+        const autoUpdate = DatabaseService.getInstance().getGlobalSettings().trivy_auto_update === '1';
+        return autoUpdate ? this.fetchLatestVersion(true) : PINNED_TRIVY_VERSION;
     }
 
     public async uninstall(): Promise<void> {
@@ -176,10 +196,9 @@ class TrivyInstaller {
         }
     }
 
-    private async doInstall(): Promise<{ version: string }> {
-        const version = await this.fetchLatestVersion(true);
+    private async doInstall(version: string): Promise<{ version: string }> {
         if (semver.lt(version, MIN_TRIVY_VERSION)) {
-            throw new Error(`Fetched Trivy version ${version} is below minimum ${MIN_TRIVY_VERSION}`);
+            throw new Error(`Trivy version ${version} is below minimum ${MIN_TRIVY_VERSION}`);
         }
         const archTag = archAssetTag();
         const assetName = `trivy_${version}_Linux-${archTag}.tar.gz`;