fix(kyverno): refresh reports runtime dependencies

.github/workflows/ci.yaml

@@ -1192,6 +1192,11 @@ jobs:
           bash scripts/guard-test-script-exec-bit.sh .
           bash scripts/tests/test-guard-test-script-exec-bit.sh
 
+      - name: 🔒 Validate patched reports runtime publisher
+        run: |
+          shellcheck scripts/tests/test-kyverno-reports-runtime.sh
+          bash scripts/tests/test-kyverno-reports-runtime.sh
+
       - name: 🔐 Validate the documentation tenant scope
         run: |
           shellcheck scripts/tests/test-khoist-documentation-tenant.sh

.github/workflows/publish-kyverno-reports-hotfix.yaml

@@ -23,9 +23,9 @@ concurrency:
 
 env:
   SOURCE_COMMIT: e63308f1e16c05cd009ac4864be6ec25c66b49be
-  PATCHED_SOURCE_TREE: 55d2b33849e13fa3470646b0b25fda4970dd11b7
+  PATCHED_SOURCE_TREE: bb6b1b1c14b27fe1c752ca001555907590011d67
   IMAGE: ghcr.io/devantler-tech/platform-kyverno-reports
-  IMAGE_TAG: v1.19.2-watch-plan.1-${{ github.sha }}
+  IMAGE_TAG: v1.19.2-watch-plan.2-${{ github.sha }}
 
 jobs:
   verify:
@@ -60,10 +60,14 @@ jobs:
         run: |
           set -euo pipefail
           test "$(git rev-parse HEAD)" = "${SOURCE_COMMIT}"
+          git fetch --no-write-fetch-head --depth=1 origin +refs/tags/v1.19.2:refs/tags/v1.19.2
+          test "$(git rev-parse "refs/tags/v1.19.2^{commit}")" = "${SOURCE_COMMIT}"
           git apply --check --unidiff-zero "${HOTFIX_PATCH}"
           git apply --unidiff-zero "${HOTFIX_PATCH}"
           git diff --check
-          git add -- go.mod pkg/controllers/report/resource/controller.go \
+          git add -- cmd/internal/registry_security_test.go go.mod go.sum \
+            third_party/docker-credential-acr-env/ \
+            pkg/controllers/report/resource/controller.go \
             pkg/controllers/report/resource/controller_test.go \
             pkg/controllers/report/resource/watch_kinds.go \
             pkg/controllers/report/resource/watch_plan_test.go
@@ -100,8 +104,8 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-      packages: write
-      id-token: write
+      packages: write # publish the tested image at an immutable source tag
+      id-token: write # sign through this protected main workflow identity
     steps:
       - name: Harden runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
@@ -128,10 +132,14 @@ jobs:
         run: |
           set -euo pipefail
           test "$(git rev-parse HEAD)" = "${SOURCE_COMMIT}"
+          git fetch --no-write-fetch-head --depth=1 origin +refs/tags/v1.19.2:refs/tags/v1.19.2
+          test "$(git rev-parse "refs/tags/v1.19.2^{commit}")" = "${SOURCE_COMMIT}"
           git apply --check --unidiff-zero "${HOTFIX_PATCH}"
           git apply --unidiff-zero "${HOTFIX_PATCH}"
           git diff --check
-          git add -- go.mod pkg/controllers/report/resource/controller.go \
+          git add -- cmd/internal/registry_security_test.go go.mod go.sum \
+            third_party/docker-credential-acr-env/ \
+            pkg/controllers/report/resource/controller.go \
             pkg/controllers/report/resource/controller_test.go \
             pkg/controllers/report/resource/watch_kinds.go \
             pkg/controllers/report/resource/watch_plan_test.go
@@ -176,7 +184,7 @@ jobs:
           DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           set -euo pipefail
-          test -n "${DIGEST}"
+          [[ "${DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]]
           cosign sign --yes "${IMAGE}@${DIGEST}"
           cosign verify \
             --certificate-identity "https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-reports-hotfix.yaml@refs/heads/main" \

k8s/bases/infrastructure/controllers/kyverno/ReportsWatchPlan.Dockerfile

@@ -1,17 +1,38 @@
-FROM docker.io/library/golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 AS builder
+FROM docker.io/library/golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS builder
+ENV GOTOOLCHAIN=local
 WORKDIR /src
 COPY go.mod go.sum ./
+COPY third_party/docker-credential-acr-env/ ./third_party/docker-credential-acr-env/
 RUN go mod download && go mod verify
 COPY . .
 RUN timeout 900s go test -mod=readonly -race ./pkg/controllers/report/resource ./pkg/controllers/report/aggregate ./pkg/webhooks/resource/validation
+RUN timeout 300s go test -mod=readonly -race ./cmd/internal/... ./pkg/image/... ./pkg/tracing/... ./pkg/metrics/... \
+    github.com/chrismellard/docker-credential-acr-env/pkg/...
 # Upstream code is not ours to restyle: only lines the hotfix patch changes can fail this gate.
-RUN GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 \
-    && timeout 900s golangci-lint run --timeout=14m --new-from-patch=reports-watch-plan.patch \
-        ./pkg/controllers/report/resource/...
+# Include every Go package changed by the runtime patch, including its local replacement module.
+RUN GOWORK=/tmp/reports-lint.work go work init . ./third_party/docker-credential-acr-env \
+    && GOBIN=/usr/local/bin go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.15.0 \
+    && GOWORK=/tmp/reports-lint.work timeout 900s golangci-lint run --timeout=14m --new-from-patch=reports-watch-plan.patch \
+        ./pkg/controllers/report/resource/... ./cmd/internal/... \
+        ./third_party/docker-credential-acr-env/pkg/...
 ARG VERSION=unknown
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=readonly -trimpath \
-    -ldflags="-s -w -X github.com/kyverno/kyverno/pkg/version.BuildVersion=${VERSION}" \
-    -o /out/reports-controller ./cmd/reports-controller
+# Preserve the symbol table so executable scans can distinguish linked packages
+# from conservative module-level findings; omit only DWARF debug information.
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=readonly -buildvcs=true -trimpath \
+    -ldflags="-w -X github.com/kyverno/kyverno/pkg/version.BuildVersion=${VERSION}" \
+    -o /out/reports-controller ./cmd/reports-controller \
+    && test "$(go version /out/reports-controller)" = "/out/reports-controller: go1.27.3" \
+    && go version -m /out/reports-controller > /tmp/reports-build-info \
+    && awk '$1 == "mod" && $2 == "github.com/kyverno/kyverno" && $3 == "v1.19.2+dirty" {module++} \
+      $1 == "build" && $2 == "vcs.revision=e63308f1e16c05cd009ac4864be6ec25c66b49be" {revision++} \
+      END {exit(module != 1 || revision != 1)}' /tmp/reports-build-info
+RUN go list -mod=readonly -deps ./cmd/reports-controller > /tmp/reports-packages \
+    && if grep -Eq '^golang.org/x/crypto/openpgp(/|$)' /tmp/reports-packages; then \
+         echo 'Unsafe OpenPGP package in reports runtime'; exit 1; \
+       else test "$?" -eq 1; fi
+RUN GOBIN=/usr/local/bin go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 \
+    && timeout 300s govulncheck ./cmd/reports-controller \
+    && timeout 120s govulncheck -mode=binary /out/reports-controller
 
 FROM reg.kyverno.io/kyverno/reports-controller:v1.19.2@sha256:5fb6d3e738050dbce84f60ecabaede7665fbe0578d07c1e8c912443b035e79c3
 COPY --from=builder --chmod=0755 /out/reports-controller /ko-app/reports-controller