Consolidate container CVE findings under burn-down tracker

[Copilot]

Recurring per-version container scan issues were fragmenting CVE triage across firewall and related runtime images. The existing burn-down tracker is now the single operational record.

• Tracker lifecycle

  • Updates the existing Container CVE burn-down issue with current summary and per-image details.
  • Assigns pelikhan as the explicit triage owner.

• Duplicate suppression

  • Stops creating per-image finding issues.
  • Closes open Container findings for ... issues as duplicates of the burn-down tracker.
  • Preserves a separate, assigned issue path for scan operational failures.

close-issue:
  target: "*"
  required-title-prefix: "[container-image-scan] Container findings for "
  required-labels: [cookie, security]
  state-reason: duplicate

• Fixes [uk-ai-resilience] Consolidate recurring gh-aw-firewall container image CVE scan issues under burn-down tracker #53417

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.29 AIC · ⌖ 7.25 AIC · ⊞ 8.8K · ◷
_{Comment /souschef to run again}

[github-actions]

Great work consolidating the container CVE tracking! 🎯 This PR successfully addresses the fragmentation issue raised in #53417 by routing all findings through the existing burn-down tracker (#52657) instead of creating recurring per-image issues.

What looks good:

• Clear motivation and scope — consolidating CVE triage under a single operational record reduces drift and improves ownership visibility.
• Focused changes — both the lock file and workflow definition are updated consistently to support close_issue, update_issue, and assign_to_user operations.
• Strong description — includes concrete examples (e.g., the close-issue YAML configuration) and explicit owner assignment (pelikhan).
• Fixes a documented operational issue ([uk-ai-resilience] Consolidate recurring gh-aw-firewall container image CVE scan issues under burn-down tracker #53417) with measurable impact on security scanning hygiene.

This looks ready for review and merge. Nice workflow automation improvement! ✨

Generated by ✅ Contribution Check · auto · 58.2 AIC · ⌖ 4.38 AIC · ⊞ 9.1K · ◷

[github-actions]

🔬 Test Quality Sentinel is analyzing test quality on this pull request...

[github-actions]

🔎 PR Code Quality Reviewer is reviewing code quality for this pull request...

[github-actions]

REQUEST_CHANGES

This rewrite has the right intent, but it introduces a prompt/config contradiction and a brittle hard-coded tracker dependency that can break the daily scan workflow without any compile-time signal.

Blocking themes

• The workflow text still claims create-issue is the only allowed write path even though this PR requires update-issue, assign-to-user, and close-issue.
• The single-tracker flow is pinned to a raw issue number in multiple places, which will rot silently the next time the tracker is migrated or recreated.

🔎 Code quality review by PR Code Quality Reviewer · gpt54 · 7.03 AIC · ⌖ 6.6 AIC · ⊞ 4.5K
_{Comment /review to run again}

Comments that could not be inline-anchored

.github/workflows/daily-squid-image-scan.md:124

The workflow prompt now instructs the agent to use update_issue, assign_to_user, and close_issue, but the checked-in workflow text still says The configured create-issue safe output is the only allowed write operation. That contradiction will push the runtime model toward treating the newly required tools as forbidden, so the scan job can noop or fail instead of updating #52657 and closing duplicates.

<details><summary>💡 Why this is blocking</summary>

The whole behavioral change in t…

.github/workflows/daily-squid-image-scan.md:29

This change hard-codes assign-to-user and update-issue to issue 52657, but the workflow prompt only names that issue in prose and never states what to do if the tracker is replaced or recreated. The next burn-down issue migration will silently break this automation, because the agent will keep writing to the stale number and has no escape hatch.

<details><summary>💡 Why this is worth fixing now</summary>

You are moving from per-image issue creation to a single long-lived tracker, so the…

[Copilot]

Pull request overview

Consolidates container scan findings into the existing CVE burn-down tracker while retaining operational-failure reporting.

Changes:

• Updates and assigns tracker #52657.
• Closes legacy per-image issues as duplicates.
• Limits issue creation to operational failures.

Show a summary per file

File	Description
.github/workflows/daily-squid-image-scan.md	Defines consolidated tracking behavior and safe outputs.
.github/workflows/daily-squid-image-scan.lock.yml	Regenerates the compiled workflow.

Review details

Suppressed comments (1)

.github/workflows/daily-squid-image-scan.md:108

• The final Output Format rule still says that create-issue is the only allowed write operation. That directly contradicts this required update-issue call (as well as assignment and closure), so the agent may skip the core consolidation actions. Make the rule refer to all configured safe outputs.

6. If there are no findings and no operational errors, update #52657 to show
     the clean scan, then call `noop`.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

done

[github-actions]

PR Triage

Category: refactor (workflow behavior change) · Risk: medium · Score: 48/100 (Impact 25, Urgency 10, Quality 13)

Recommended action: defer

Consolidates per-image container CVE issues into a single burn-down tracker (#52657), adding update-issue, assign-to-user, and close-issue safe outputs to the daily squid scan workflow. The AI code-quality reviewer requested changes (now dismissed after updates) flagging: (1) a prompt/config contradiction — the workflow text still claims create-issue is the only allowed write path, and (2) a brittle hard-coded dependency on issue #52657 with no fallback if the tracker is recreated. These need addressing before merge given this touches operational security-scan automation.

Generated by 🔧 PR Triage Agent · auto · 45.8 AIC · ⌖ 2.4 AIC · ⊞ 8.1K · ◷

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.1