fix: OS package upgrades run on every image build, so Trivy stops failing on fixes the cache hid (#417)

Author: HardMax71

.github/workflows/ci.yml

@@ -469,6 +469,8 @@ jobs:
           tags: integr8scode-frontend:latest
           cache-from: type=gha,scope=frontend
           cache-to: type=gha,mode=max,scope=frontend
+          # A cached `apk upgrade` layer would keep OS packages from the day it was cached
+          no-cache-filters: production
 
       # ── Push all images to GHCR in parallel ────────────────────────
       - name: Push all images to GHCR

backend/Dockerfile

@@ -32,7 +32,7 @@ FROM python:3.14-slim AS base
 WORKDIR /app
 
 # Runtime libs only (no -dev headers, no gcc); uv installs the app, so pip goes too, since its vendored packages trip the scan
-RUN apt-get update && apt-get upgrade -y \
+RUN apt-get update \
     && apt-get install -y --no-install-recommends \
     curl \
     liblzma5 \
@@ -57,6 +57,9 @@ ENV OTEL_SEMCONV_STABILITY_OPT_IN=http
 
 FROM base
 
+# CI caches the base stage's layers, so OS fixes released after that come in here, on every build
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 # Copy application files and configuration
 COPY ./app /app/app
 COPY ./scripts /app/scripts

docs/security/supply-chain.md

@@ -10,7 +10,7 @@ Findings show up in the repository's Security tab under code scanning, as `backe
 
 ## Image and code scans
 
-Docker Scan & Promote runs Trivy v0.75.0 on the `backend` and `frontend` images of every commit that passed CI on `main`. It reports `CRITICAL` and `HIGH` findings that have a fix, skips anything listed in `backend/.trivyignore`, and uploads SARIF per image as `trivy-<image>`. A finding fails the job and blocks the promote to `latest`. The images keep the count at zero by upgrading their OS packages at build time, and the backend drops pip, whose vendored packages were the only Python findings. The ignore file lists no CVE today. See [CI/CD](../operations/cicd.md#docker-scan-promote).
+Docker Scan & Promote runs Trivy v0.75.0 on the `backend` and `frontend` images of every commit that passed CI on `main`. It reports `CRITICAL` and `HIGH` findings that have a fix, skips anything listed in `backend/.trivyignore`, and uploads SARIF per image as `trivy-<image>`. A finding fails the job and blocks the promote to `latest`. The images keep the count at zero by upgrading their OS packages in a step CI never caches (the backend's last stage, the frontend's `production` stage), so a fix released after a cached build still gets in, and the backend drops pip, whose vendored packages were the only Python findings. The ignore file lists no CVE today. See [CI/CD](../operations/cicd.md#docker-scan-promote).
 
 CI's Security Scanning job runs `uvx --no-build --python 3.14 bandit==1.9.4 -r backend/ -x backend/tests/ -ll` on pushes to `main` and on PRs that change `backend/`. `-ll` reports medium severity and up, and any finding fails the workflow.
 

frontend/Dockerfile

@@ -11,7 +11,7 @@ RUN npm run build
 
 # --8<-- [start:production_stage]
 # Production stage
-FROM nginx:1.31-alpine
+FROM nginx:1.31-alpine AS production
 
 # Upgrade the base image's packages to pick up fixes newer than the image, and add curl for the healthcheck and openssl for the certificate
 RUN apk upgrade --no-cache && apk add --no-cache curl openssl