fix: Vulnerability scans (#12)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: KevinBoyerAtNava

.dockleconfig

@@ -1,6 +1,6 @@
-# This file is allows you to specify a list of files that is acceptable to Dockle
+# This file allows you to specify a list of files that is acceptable to Dockle
+# Use this file for overrides that should affect every app in the repository (currently one, our API)
+# For overrides specific to a particular app, use that app's .dockleconfig
 # To allow multiple files, use a list of names, example below. Make sure to remove the leading #
-# DOCKLE_ACCEPT_FILES="file1,path/to/file2,file3/path,etc"
-# https://github.com/goodwithtech/dockle#accept-suspicious-environment-variables--files--file-extensions
-
-DOCKLE_ACCEPT_FILES="app/.venv/lib/python3.12/site-packages/hayhooks/settings.py,app/.venv/lib/python3.12/site-packages/phoenix/otel/settings.py"
+# DOCKLE_ACCEPT_FILES=file1,path/to/file2,file3/path,etc
+# https://github.com/goodwithtech/dockle#accept-suspicious-environment-variables--files--file-extensions

.github/workflows/vulnerability-scans.yml

@@ -149,6 +149,9 @@ jobs:
           if grep -q "^DOCKLE_ACCEPT_FILES=.*" ${{ steps.dockle-config.outputs.found_file }}; then
             grep -s '^DOCKLE_ACCEPT_FILES=' ${{ steps.dockle-config.outputs.found_file }} >> "$GITHUB_ENV"
           fi
+          if grep -q "^DOCKLE_IGNORES=.*" ${{ steps.dockle-config.outputs.found_file }}; then
+            grep -s '^DOCKLE_IGNORES=' ${{ steps.dockle-config.outputs.found_file }} >> "$GITHUB_ENV"
+          fi
 
       - name: Run Dockle container linter
         uses: erzz/dockle-action@v1.3.1

.grype.yml

@@ -18,3 +18,8 @@ ignore:
   - fix-state: unknown
   # https://github.com/anchore/grype/issues/1172
   - vulnerability: GHSA-xqr8-7jwr-rhp7
+  # These have been backported to Python 3.12.11, but not yet
+  # updated in the grype database
+  # See: https://security.snyk.io/package/linux/chainguard:latest/python-3.12
+  - vulnerability: CVE-2025-8194
+  - vulnerability: CVE-2025-6069

app/.dockleconfig

@@ -1,8 +1,10 @@
-# This file is allows you to specify a list of files that is acceptable to Dockle
+# This file allows you to specify a list of files that is acceptable to Dockle
 # To allow multiple files, use a list of names, example below. Make sure to remove the leading #
-# DOCKLE_ACCEPT_FILES="file1,path/to/file2,file3/path,etc"
+# DOCKLE_ACCEPT_FILES=file1,path/to/file2,file3/path,etc
 # https://github.com/goodwithtech/dockle#accept-suspicious-environment-variables--files--file-extensions
-# DOCKLE_ACCEPT_FILES="file1,path/to/file2,file3/path,etc"
 
 # Hayhooks has an out of the box example and it uses a settings file, we don't need or use it but need to ignore it
-DOCKLE_ACCEPT_FILES="app/.venv/lib/python3.12/site-packages/hayhooks/settings.py,app/.venv/lib/python3.12/site-packages/phoenix/otel/settings.py"
+DOCKLE_ACCEPT_FILES=app/.venv/lib/python3.12/site-packages/hayhooks/settings.py,app/.venv/lib/python3.12/site-packages/phoenix/otel/settings.py
+
+# python:3.12-slim doesn't clear package caches after apt-get install; we do so in our own Dockerfile
+DOCKLE_IGNORES=DKL-DI-0005

app/Dockerfile

@@ -16,15 +16,15 @@ RUN apt-get update \
     # https://pythonspeed.com/articles/security-updates-in-docker/
     && apt-get upgrade --yes \
     && apt-get install --no-install-recommends --yes \
-    # build-essential \
-    # libpq-dev \
-    # postgresql \
-    # wget \
     # Reduce the image size by clear apt cached lists
     # Complies with https://github.com/codacy/codacy-hadolint/blob/master/codacy-hadolint/docs/description/DL3009.md
     && rm -rf /var/lib/apt/lists \
     && rm -f /etc/ssl/private/ssl-cert-snakeoil.key
 
+# The system version of this library in python:3.12-slim contains
+# a vulnerability, so upgrade it
+RUN pip install --no-cache-dir --upgrade urllib3==2.5.0
+
 ARG RUN_UID
 ARG RUN_USER