feat: pre-deploy scan visibility and pinned scanner version (#1378)

* feat: pre-deploy scan visibility and pinned scanner version Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a manual deploy can surface each image's latest scan before it runs. - Managed Trivy now installs a pinned, known-good version by default for reproducible installs. Auto-update still tracks the latest release, and an explicit update always pulls the latest. - Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from the editor first shows each image's latest cached scan severity for review. It is visibility only and never blocks; deploy enforcement is unchanged. - Backend: pre_deploy_scan_advisory setting, PUT /security/pre-deploy-scan-advisory, a cache-only GET /security/stacks/:name/pre-deploy-summary, and a node-scoped getLatestVulnScanByDigestForNode lookup. - Frontend: advisory toggle on the Security page scanner setup, and a PreDeployScanDialog wired into the editor deploy flow that fails open when the summary is unavailable. - Docs: scanner configuration, version pinning, and the advisory. * fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state Addresses review findings on the pre-deploy advisory. - Block a second editor deploy during the async advisory window with a synchronous pending ref, cleared on cancel and in the deploy's finally, so a double-click can no longer start two deploys. - Keep the pre-deploy advisory toggle visible to admins whenever the setting is on, so it can still be turned off after the scanner becomes unavailable. - Resolve the managed Trivy version inside the install lock so the busy state and serialization cover the latest-version fetch and the managed-install check.
2026-08-07 01:14:14 +00:00 · 2026-06-16 00:42:33 -04:00
parent 770bead889
commit 7ce045accb
21 changed files with 1093 additions and 23 deletions
@@ -0,0 +1,78 @@
+import {
+  Modal,
+  ModalHeader,
+  ModalBody,
+  ModalFooter,
+} from '@/components/ui/modal';
+import { Button } from '@/components/ui/button';
+import { SeverityChip } from '@/components/VulnerabilityScanSheet';
+import { formatTimeAgo } from '@/lib/relativeTime';
+import type { PreDeployScanImage } from '@/types/security';
+
+interface PreDeployScanDialogProps {
+  open: boolean;
+  stackName: string;
+  images: PreDeployScanImage[];
+  onCancel: () => void;
+  onDeploy: () => void;
+}
+
+/**
+ * Advisory pre-deploy review. Shows the latest cached scan for each image in a
+ * manual deploy so the operator can review the security posture before
+ * proceeding. Unlike PolicyBlockDialog this never blocks: anyone can deploy or
+ * cancel, and there is no override gate (blocking is the paid deploy-block
+ * policy). Opened opt-in via the pre-deploy scan advisory setting.
+ */
+export function PreDeployScanDialog({ open, stackName, images, onCancel, onDeploy }: PreDeployScanDialogProps) {
+  return (
+    <Modal open={open} onOpenChange={(next) => { if (!next) onCancel(); }} size="xl">
+      <ModalHeader
+        kicker={`${stackName.toUpperCase()} · PRE-DEPLOY · SCAN REVIEW`}
+        title="Review scan results before deploying"
+        description="The latest vulnerability scan for each image in this deploy. Advisory only; it does not block the deploy."
+      />
+      <ModalBody>
+        <div className="border border-glass-border bg-card/60 shadow-card-bevel divide-y divide-glass-border">
+          {images.length === 0 ? (
+            <div className="px-4 py-3 text-sm text-muted-foreground">No images found for this stack.</div>
+          ) : (
+            images.map((img) => (
+              <div key={img.imageRef} className="px-4 py-3 flex items-center justify-between gap-4">
+                <div className="min-w-0">
+                  <div className="font-mono text-sm truncate">{img.imageRef}</div>
+                  <div className="font-mono text-[10px] uppercase tracking-[0.18em] text-stat-subtitle tabular-nums">
+                    {img.scan
+                      ? `${img.scan.criticalCount} critical · ${img.scan.highCount} high · ${img.scan.mediumCount} medium · ${img.scan.lowCount} low · scanned ${formatTimeAgo(img.scan.scannedAt)}`
+                      : 'not scanned'}
+                  </div>
+                </div>
+                {img.scan?.highestSeverity ? (
+                  <SeverityChip severity={img.scan.highestSeverity} />
+                ) : null}
+              </div>
+            ))
+          )}
+        </div>
+      </ModalBody>
+      <ModalFooter
+        secondary={
+          <Button variant="outline" size="sm" onClick={onCancel}>
+            Cancel
+          </Button>
+        }
+        primary={
+          <Button
+            size="sm"
+            onClick={(e) => {
+              e.preventDefault();
+              onDeploy();
+            }}
+          >
+            Deploy
+          </Button>
+        }
+      />
+    </Modal>
+  );
+}
@@ -0,0 +1,49 @@
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+import { PreDeployScanDialog } from '../PreDeployScanDialog';
+import type { PreDeployScanImage } from '@/types/security';
+
+const images: PreDeployScanImage[] = [
+  {
+    imageRef: 'nginx:1.14',
+    scan: {
+      criticalCount: 31,
+      highCount: 82,
+      mediumCount: 1,
+      lowCount: 4,
+      highestSeverity: 'CRITICAL',
+      scannedAt: Date.now() - 3_600_000,
+    },
+  },
+  { imageRef: 'redis:7', scan: null },
+];
+
+describe('PreDeployScanDialog', () => {
+  it('renders each image with its scan counts or a not-scanned note', () => {
+    render(
+      <PreDeployScanDialog open stackName="web" images={images} onCancel={vi.fn()} onDeploy={vi.fn()} />,
+    );
+    expect(screen.getByText('nginx:1.14')).toBeInTheDocument();
+    expect(screen.getByText(/31 critical/)).toBeInTheDocument();
+    expect(screen.getByText('redis:7')).toBeInTheDocument();
+    expect(screen.getByText('not scanned')).toBeInTheDocument();
+  });
+
+  it('calls onDeploy when Deploy is clicked', () => {
+    const onDeploy = vi.fn();
+    render(
+      <PreDeployScanDialog open stackName="web" images={images} onCancel={vi.fn()} onDeploy={onDeploy} />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Deploy' }));
+    expect(onDeploy).toHaveBeenCalledTimes(1);
+  });
+
+  it('calls onCancel when Cancel is clicked', () => {
+    const onCancel = vi.fn();
+    render(
+      <PreDeployScanDialog open stackName="web" images={images} onCancel={onCancel} onDeploy={vi.fn()} />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onCancel).toHaveBeenCalledTimes(1);
+  });
+});