Skip to content

fix(query): the "Image Version Using Latest" dockerfile query was not accounting for specific digest values #8033

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cx-andre-pereira wants to merge 5 commits into
base: master
Choose a base branch
from
+11 −1
Open

fix(query): the "Image Version Using Latest" dockerfile query was not accounting for specific digest values #8033

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ed16fa9
Fix check for ':latest' to ensure it is used as a sufix on the image …
cx-andre-pereira Apr 9, 2026
3795843
Requested change
cx-andre-pereira Apr 9, 2026
7340108
Merge branch 'master' into AST-145728--FP_Dockerfile_latest_tag
cx-andre-pereira Apr 14, 2026
c43a95e
Merge branch 'master' into AST-145728--FP_Dockerfile_latest_tag
cx-andre-pereira Apr 22, 2026
f61f9f9
Merge branch 'master' into AST-145728--FP_Dockerfile_latest_tag
cx-andre-pereira Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion assets/queries/dockerfile/image_version_using_latest/query.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ CxPolicy[result] {
resource := input.document[i].command[name][_]
resource.Cmd == "from"
not resource.Value[0] == "scratch"
contains(resource.Value[0], ":latest")
regex.match(":latest\\s*$", resource.Value[0])
Comment thread
cx-andre-pereira marked this conversation as resolved.
Outdated

result := {
"documentId": input.document[i].id,
Expand Down
10 changes: 10 additions & 0 deletions assets/queries/dockerfile/image_version_using_latest/test/negative.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,14 @@ RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5000
CMD ["python", "/usr/src/app/app.py"]

FROM 923847651029.dkr.ecr.eu-west-1.amazonaws.com/echo/echo-fips:latest@sha256:a1f3c2e9b0d74682f5a3c1e8b2d09f47c6e1a3b8d2f04c7e9a1b3d5f7c2e4a6b8
RUN apk add --update py2-pip
RUN pip install --upgrade pip
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5001
CMD ["python", "/usr/src/app/app.py"]
Loading