1---2name: scan-vulnerabilities3description: Scan container image for security vulnerabilities before deployment. Uses Quay vulnerability scanning. Use before release, ephemeral deploy, or MR approval. Use when user says "scan vulnerabilities", "security scan".4---56# Scan Vulnerabilities78## Inputs910| Input | Type | Default | Purpose |11|-------|------|---------|---------|12| `image_tag` | string | required | Image tag (commit SHA or version) to scan |13| `repository` | string | aap-aa-tenant/aap-aa-main/automation-analytics-backend-main | Quay repository path |14| `namespace` | string | redhat-user-workloads | Quay namespace (redhat-user-workloads for PR, redhat-services-prod for releases) |15| `fail_on_critical` | bool | true | Return error if critical vulnerabilities found |16| `fail_on_high` | bool | false | Return error if high severity found |17| `scan_source` | bool | false | Also run source code security scan (bandit/npm audit) |1819## Workflow2021### 1. Bootstrap22- `persona_load("release")` — quay tools23- `check_known_issues("quay", "")`, `check_known_issues("security", "")`24- `knowledge_query(project="automation-analytics-backend", persona="devops", section="gotchas")`2526### 2. Verify Image27- `quay_check_image_exists(repository="{repository}", tag="{image_tag}", namespace="{namespace}")`28- Stop if image not found — build may not be complete2930### 3. Get Vulnerabilities31- `quay_get_vulnerabilities(repository="{repository}", tag="{image_tag}", namespace="{namespace}")`32- `quay_get_manifest(repository="{repository}", tag="{image_tag}", namespace="{namespace}")` — metadata3334### 4. Analyze Results35- Parse severity counts: critical, high, medium, low36- Extract CVE IDs37- Determine status: critical > 0 → blocked, else safe_to_deploy38- If `fail_on_critical` and critical > 0 → block39- If `fail_on_high` and high > 0 → block4041### 5. Source Scan (optional)42- If `scan_source`: `security_scan(repo="{repo}")` — bandit/npm audit4344### 6. Report45- Log: `memory_session_log("Security scan", "Critical: {n}, Total: {total}")`46- Block deployment if policy violated4748### 7. Failure Learning49- Manifest unknown → `learn_tool_fix("quay_get_vulnerabilities", "manifest unknown", "Image not in Quay", "Wait for Konflux build")`50- Unauthorized → `learn_tool_fix("quay_get_vulnerabilities", "unauthorized", "Quay auth failed", "Check config.json")`51- Rate limit → `learn_tool_fix("quay_get_vulnerabilities", "rate limit", "API rate limit", "Wait and retry")`5253## Key MCP Tools5455- `persona_load`, `quay_check_image_exists`, `quay_get_vulnerabilities`, `quay_get_manifest`56- `check_known_issues`, `learn_tool_fix`, `knowledge_query`, `memory_session_log`5758## Quay Namespaces5960- **redhat-user-workloads** — staging/PR images61- **redhat-services-prod** — production images6263## Recommendation6465- If critical > 0: block deployment66- If high > 0: review before deploying67- Run `skill_run("cve_fix", ...)` to auto-remediate fixable CVEs in Python deps6869## Next Step7071```python72skill_run("cve_fix", '{"downstream_component": "automation-analytics-backend"}')73```
dmzoneill