fix(vhd-scanning): install trivy from PMC with version pinning and Renovate tracking by djsly · Pull Request #8248 · Azure/AgentBaker

djsly · 2026-04-07T22:07:45Z

Summary

Fixes trivy installation for VHD scanning by using PMC packages with version pinning and Renovate tracking, replacing the previous direct GitHub download approach.

Changes

trivy-scan.sh

PMC install for Ubuntu (per-flavor): Uses apt_get_install with exact version pinning from the pre-existing Microsoft PMC prod repo on the VHD. Each Ubuntu version has its own Renovate-tracked variable:
- TRIVY_DEB_2004_VERSION → tracked via custom.deb2004 (Ubuntu 20.04 / focal)
- TRIVY_DEB_2204_VERSION → tracked via custom.deb2204 (Ubuntu 22.04 / jammy)
- TRIVY_DEB_2404_VERSION → tracked via custom.deb2404 (Ubuntu 24.04 / noble)
PMC install for AzureLinux: Uses dnf_install with full NEVR pinning (trivy-0.68.2-7.azl3) from the cloud-native PMC repo
- TRIVY_RPM_VERSION → tracked via rpm datasource with registryUrl pointing to AzureLinux 3.0 cloud-native repodata
GitHub fallback for SKUs without PMC packages (Flatcar, AzureContainerLinux, AzureLinuxOSGuard): Uses a dedicated TRIVY_GITHUB_VERSION pinned to an actual upstream GitHub release (0.69.2), tracked via github-releases datasource. PMC versions (0.68.x) are Microsoft-internal builds with no matching GitHub release tags, so the fallback version must be tracked independently.
- Downloads include SHA256 checksum verification from the upstream trivy__checksums.txt
- All download/verify/extract steps have explicit error handling (|| exit 1)
Scan invocations changed from ./trivy → trivy (PMC installs to PATH)

.github/renovate.json

New custom manager: Dedicated regex for trivy-scan.sh supporting deb annotations (with versioning) and rpm annotations (with registryUrl) via optional named capture groups. Also tracks TRIVY_GITHUB_VERSION via the standard github-releases datasource.
Package rule: Matches both trivy (PMC) and aquasecurity/trivy (GitHub fallback), assigns to Azure/aks-node-lifecycle team
Team consolidation: Replaced individual user lists with Azure/aks-node-lifecycle GitHub team across all 6 Renovate package rules previously using manual user entries

How Renovate tracking works

When PMC publishes a new trivy version:

Ubuntu 20.04: Renovate detects via custom.deb2004, updates TRIVY_DEB_2004_VERSION
Ubuntu 22.04: Renovate detects via custom.deb2204, updates TRIVY_DEB_2204_VERSION
Ubuntu 24.04: Renovate detects via custom.deb2404, updates TRIVY_DEB_2404_VERSION
AzureLinux 3.0: Renovate detects via rpm datasource against cloud-native repodata, updates TRIVY_RPM_VERSION
GitHub fallback: Renovate detects new upstream releases via github-releases, updates TRIVY_GITHUB_VERSION
Azure/aks-node-lifecycle team reviews and merges
Next VHD build picks up the new version

Copilot

Pull request overview

Updates the VHD post-build scanning script to stop downloading Trivy from GitHub releases and instead install it via the OS package manager (PMC-backed), then run scans using the system trivy binary.

Changes:

Removed hardcoded Trivy version/arch and the GitHub curl/tar install flow.
Added install_trivy() to install Trivy via apt (Ubuntu) or dnf (AzureLinux/Mariner).
Switched scan invocations from ./trivy to trivy and removed the local binary cleanup.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

…novate tracking - Install trivy from Microsoft PMC prod repo for Ubuntu (apt) and AzureLinux (dnf) instead of downloading from GitHub releases - Pin to a specific version (TRIVY_VERSION) tracked by Renovate via the custom.deb2404 PMC datasource with deb versioning - Version is extracted (base version without deb suffix) and used for: - apt version pinning: trivy=<base_version>* - dnf version pinning: trivy-<base_version> - GitHub fallback for unsupported SKUs (CBLMariner, Flatcar, etc.) - Add dedicated Renovate custom manager for trivy-scan.sh with a working regex that correctly captures all annotation fields - Add Renovate package rule to assign trivy updates to the team Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

PMC trivy versions (e.g., 0.68.2) are Microsoft-internal builds that don't have matching GitHub release tags (upstream jumped from v0.26.0 to v0.69.2). The fallback install_trivy_from_github() was extracting the base version from TRIVY_DEB_2404_VERSION, causing 404 errors on Flatcar, ACL, and OSGuard SKUs. Add a dedicated TRIVY_GITHUB_VERSION variable pinned to an actual upstream release (0.69.2) with Renovate tracking via github-releases datasource. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…eb versions - Add SHA256 checksum verification for GitHub fallback downloads using upstream trivy_<version>_checksums.txt - Use full deb version strings (e.g., 0.68.2-ubuntu24.04u7) for apt pinning instead of stripping the distro suffix with %%-* - Remove glob wildcard from apt_get_install version pin Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove anujmaheshwari1, add mxj220, pdamianov-dev, SriHarsha001. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…den GitHub fallback - Replace individual user lists with Azure/aks-node-lifecycle GitHub team across all 6 Renovate package rules where nodesig members were listed - Add aquasecurity/trivy to trivy matchPackageNames for GitHub fallback coverage - Add explicit error handling (|| exit 1) to GitHub fallback download/verify steps Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move the '# renovate:' comment for TRIVY_GITHUB_VERSION to be immediately above the variable assignment, which is the standard Renovate regex manager pattern. The descriptive comments are now above the annotation instead of between it and the version string. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 7, 2026 22:07

djsly requested review from AbelHu, Devinwong, SriHarsha001, awesomenix, calvin197, cameronmeissner, ganeshkumarashok, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, sulixu, surajssd, timmy-wright and zachary-bailey as code owners April 7, 2026 22:07

djsly temporarily deployed to test April 7, 2026 22:07 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 7, 2026 22:08 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

djsly force-pushed the djsly/37444537 branch from 77865d9 to 278ea8e Compare April 7, 2026 22:13

djsly temporarily deployed to test April 7, 2026 22:13 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 7, 2026 23:08

djsly temporarily deployed to test April 7, 2026 23:08 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 7, 2026 23:09 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

djsly temporarily deployed to test April 8, 2026 00:41 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 8, 2026 01:06

djsly temporarily deployed to test April 8, 2026 01:06 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 11, 2026 03:50

djsly temporarily deployed to test April 11, 2026 03:50 — with GitHub Actions Inactive

Copilot started reviewing on behalf of djsly April 11, 2026 03:51 View session

djsly force-pushed the djsly/37444537 branch from 51c8d99 to b9892b2 Compare April 11, 2026 03:52

djsly temporarily deployed to test April 11, 2026 03:52 — with GitHub Actions Inactive

Copilot AI reviewed Apr 11, 2026

View reviewed changes

djsly force-pushed the djsly/37444537 branch from b9892b2 to 5e12b6e Compare April 11, 2026 03:56

djsly temporarily deployed to test April 11, 2026 03:56 — with GitHub Actions Inactive

awesomenix approved these changes Apr 11, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings April 13, 2026 18:36

djsly temporarily deployed to test April 13, 2026 18:36 — with GitHub Actions Inactive

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/renovate.json

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

Comment thread vhdbuilder/packer/trivy-scan.sh

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

cameronmeissner reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/renovate.json Outdated

cameronmeissner approved these changes Apr 13, 2026

View reviewed changes

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread vhdbuilder/packer/trivy-scan.sh Outdated

Comment thread .github/renovate.json

Comment thread .github/renovate.json

cameronmeissner reviewed Apr 13, 2026

View reviewed changes

Comment thread .github/renovate.json Outdated

awesomenix approved these changes Apr 13, 2026

View reviewed changes

cameronmeissner approved these changes Apr 13, 2026

View reviewed changes

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread vhdbuilder/packer/trivy-scan.sh

Comment thread .github/renovate.json

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread .github/renovate.json

Comment thread vhdbuilder/packer/trivy-scan.sh

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/renovate.json

djsly and others added 6 commits April 16, 2026 14:41

fix: update trivy renovate reviewers per Cameron's feedback

8dabde9

Remove anujmaheshwari1, add mxj220, pdamianov-dev, SriHarsha001. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Conversation

djsly commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

trivy-scan.sh

.github/renovate.json

How Renovate tracking works

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

djsly commented Apr 7, 2026 •

edited

Loading