fix(vhd-scanning): install trivy from PMC with version pinning and Renovate tracking by djsly · Pull Request #8248 · Azure/AgentBaker

djsly · 2026-04-07T22:07:45Z

Problem

trivy-scan.sh downloaded trivy directly from GitHub releases with a hardcoded TRIVY_VERSION=0.69.2, bypassing package management and subject to rate limiting. The version was not tracked by Renovate.

Changes

trivy-scan.sh

PMC install for Ubuntu (per-flavor): Uses apt_get_install with version pinning (trivy=<base_version>*) from the pre-existing Microsoft PMC prod repo on the VHD. Each Ubuntu version has its own Renovate-tracked variable:
- TRIVY_DEB_2004_VERSION → tracked via custom.deb2004 (Ubuntu 20.04 / focal)
- TRIVY_DEB_2204_VERSION → tracked via custom.deb2204 (Ubuntu 22.04 / jammy)
- TRIVY_DEB_2404_VERSION → tracked via custom.deb2404 (Ubuntu 24.04 / noble)
PMC install for AzureLinux: Uses dnf_install with full NEVR pinning (trivy-0.68.2-7.azl3) from the cloud-native PMC repo (enabled via installDeps)
- TRIVY_RPM_VERSION → tracked via rpm datasource with registryUrl pointing to AzureLinux 3.0 cloud-native repodata
GitHub fallback for SKUs without PMC packages (CBLMariner, Flatcar, AzureContainerLinux, AzureLinuxOSGuard): preserves curl/tar flow using the base version extracted from TRIVY_DEB_2404_VERSION
Scan invocations changed from ./trivy → trivy (PMC installs to PATH); rm -f ./trivy is no-op for PMC, cleanup for fallback

.github/renovate.json

New custom manager: Dedicated regex for trivy-scan.sh supporting deb annotations (with versioning) and rpm annotations (with registryUrl) via optional named capture groups
Package rule: Assigns trivy update PRs to the kubelet/kubectl review team

How Renovate tracking works

When PMC publishes a new trivy version:

Ubuntu 20.04: Renovate detects via custom.deb2004, updates TRIVY_DEB_2004_VERSION
Ubuntu 22.04: Renovate detects via custom.deb2204, updates TRIVY_DEB_2204_VERSION
Ubuntu 24.04: Renovate detects via custom.deb2404, updates TRIVY_DEB_2404_VERSION
AzureLinux 3.0: Renovate detects via rpm datasource against cloud-native repodata, updates TRIVY_RPM_VERSION
Team reviews and merges
Next VHD build picks up the new version

Note: trivy is intentionally NOT in components.json since it is a scan-only binary used during VHD scanning, not a component cached on VHDs.

Copilot

Pull request overview

Updates the VHD post-build scanning script to stop downloading Trivy from GitHub releases and instead install it via the OS package manager (PMC-backed), then run scans using the system trivy binary.

Changes:

Removed hardcoded Trivy version/arch and the GitHub curl/tar install flow.
Added install_trivy() to install Trivy via apt (Ubuntu) or dnf (AzureLinux/Mariner).
Switched scan invocations from ./trivy to trivy and removed the local binary cleanup.

vhdbuilder/packer/trivy-scan.sh

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

vhdbuilder/packer/trivy-scan.sh

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

vhdbuilder/packer/trivy-scan.sh

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

vhdbuilder/packer/trivy-scan.sh

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

…novate tracking - Install trivy from Microsoft PMC prod repo for Ubuntu (apt) and AzureLinux (dnf) instead of downloading from GitHub releases - Pin to a specific version (TRIVY_VERSION) tracked by Renovate via the custom.deb2404 PMC datasource with deb versioning - Version is extracted (base version without deb suffix) and used for: - apt version pinning: trivy=<base_version>* - dnf version pinning: trivy-<base_version> - GitHub fallback for unsupported SKUs (CBLMariner, Flatcar, etc.) - Add dedicated Renovate custom manager for trivy-scan.sh with a working regex that correctly captures all annotation fields - Add Renovate package rule to assign trivy updates to the team Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 7, 2026 22:07

djsly requested review from AbelHu, Devinwong, SriHarsha001, awesomenix, calvin197, cameronmeissner, ganeshkumarashok, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, sulixu, surajssd, timmy-wright and zachary-bailey as code owners April 7, 2026 22:07

djsly temporarily deployed to test April 7, 2026 22:07 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 7, 2026 22:08 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

vhdbuilder/packer/trivy-scan.sh Outdated Show resolved Hide resolved

djsly force-pushed the djsly/37444537 branch from 77865d9 to 278ea8e Compare April 7, 2026 22:13

djsly temporarily deployed to test April 7, 2026 22:13 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 7, 2026 23:08

djsly temporarily deployed to test April 7, 2026 23:08 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 7, 2026 23:09 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

vhdbuilder/packer/trivy-scan.sh Outdated Show resolved Hide resolved

vhdbuilder/packer/trivy-scan.sh Outdated Show resolved Hide resolved

vhdbuilder/packer/trivy-scan.sh Show resolved Hide resolved

djsly temporarily deployed to test April 8, 2026 00:41 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 8, 2026 01:06

djsly temporarily deployed to test April 8, 2026 01:06 — with GitHub Actions Inactive

djsly force-pushed the djsly/37444537 branch from 2bc5437 to 6d09059 Compare April 11, 2026 02:04

Copilot AI review requested due to automatic review settings April 11, 2026 02:04

djsly temporarily deployed to test April 11, 2026 02:04 — with GitHub Actions Inactive

djsly changed the title ~~fix(vhd-scanning): install trivy via PMC with GitHub fallback for unsupported SKUs~~ fix(vhd-scanning): install trivy from PMC with version pinning and Renovate tracking Apr 11, 2026

Copilot started reviewing on behalf of djsly April 11, 2026 02:07 View session

djsly force-pushed the djsly/37444537 branch from 6d09059 to 57a8d4b Compare April 11, 2026 02:09

djsly temporarily deployed to test April 11, 2026 02:09 — with GitHub Actions Inactive

djsly force-pushed the djsly/37444537 branch from 57a8d4b to ef6f6a3 Compare April 11, 2026 02:10

Copilot AI reviewed Apr 11, 2026

View reviewed changes

vhdbuilder/packer/trivy-scan.sh Outdated Show resolved Hide resolved

vhdbuilder/packer/trivy-scan.sh Show resolved Hide resolved

djsly temporarily deployed to test April 11, 2026 02:10 — with GitHub Actions Inactive

djsly force-pushed the djsly/37444537 branch from ef6f6a3 to a5d0776 Compare April 11, 2026 02:11

djsly temporarily deployed to test April 11, 2026 02:11 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 11, 2026 02:20

djsly force-pushed the djsly/37444537 branch from a5d0776 to 675ca7d Compare April 11, 2026 02:20

djsly temporarily deployed to test April 11, 2026 02:20 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 11, 2026 02:24 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

vhdbuilder/packer/trivy-scan.sh Outdated Show resolved Hide resolved

vhdbuilder/packer/trivy-scan.sh Show resolved Hide resolved

djsly force-pushed the djsly/37444537 branch from 675ca7d to be9e6a6 Compare April 11, 2026 03:44

djsly temporarily deployed to test April 11, 2026 03:44 — with GitHub Actions Inactive

djsly force-pushed the djsly/37444537 branch from be9e6a6 to 51c8d99 Compare April 11, 2026 03:50

Copilot AI review requested due to automatic review settings April 11, 2026 03:50

djsly temporarily deployed to test April 11, 2026 03:50 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 11, 2026 03:51 View session

djsly force-pushed the djsly/37444537 branch from 51c8d99 to b9892b2 Compare April 11, 2026 03:52

djsly temporarily deployed to test April 11, 2026 03:52 — with GitHub Actions Inactive

Copilot AI reviewed Apr 11, 2026

View reviewed changes

djsly force-pushed the djsly/37444537 branch from b9892b2 to 5e12b6e Compare April 11, 2026 03:56

djsly temporarily deployed to test April 11, 2026 03:56 — with GitHub Actions Inactive

awesomenix approved these changes Apr 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(vhd-scanning): install trivy from PMC with version pinning and Renovate tracking#8248

fix(vhd-scanning): install trivy from PMC with version pinning and Renovate tracking#8248
djsly wants to merge 1 commit intomainfrom
djsly/37444537

djsly commented Apr 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

djsly commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Changes

trivy-scan.sh

.github/renovate.json

How Renovate tracking works

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

djsly commented Apr 7, 2026 •

edited

Loading