[garrytan]

/cso's contained scanner execution was unavailable because lib/cso/scanner-images/build-inputs.json was an empty pending placeholder and cso-scanner-images.yml had never run. This PR commits reviewed, attested inputs for all six scanners on both native platforms, and fixes the gstack defects the first qualification run would have hit.

Reviewed scanner inputs

build-inputs.json now pins, for gitleaks 8.30.1, OSV-Scanner 2.6.0, Semgrep 1.179.0, zizmor 1.30.1, Trivy 0.75.0 and Schemathesis 4.29.1 on linux/amd64 and linux/arm64, plus the BuildKit SBOM generator:

• one immutable base image each;
• its GitHub repository, source commit, release, signer workflow and signer digest;
• canonical SLSA and SPDX statement-set digests.

None of the upstream images publish GitHub artifact attestations, so the bases come from garrytan/gstack-cso-scanner-bases release bases-2026.10.04.3. That repo re-publishes each pinned upstream digest (checked for tag drift, platform membership and revision label; Trivy's cosign signature is verified too) and adds the offline assets:

• Semgrep: a security-rule subset of the LGPL opengrep-rules fork, because Semgrep's registry rules forbid redistribution.
• OSV: exports for 11 ecosystems.
• Trivy: the vulnerability DB plus the misconfiguration checks bundle.

The repo's workflow signs provenance and the SBOM.

Before the state changed to reviewed, Garry double-checked an independent re-verification run from outside CI:

• Attestations: 13/13 images verified with gstack's exact gh attestation verify flags, for both predicates, plus a negative control.
• Statement digests: 26/26 recomputed with scripts/cso-attestation-evidence.ts, all equal.
• Pinned upstream: 12/12 bases have the upstream layers as an exact prefix.
• Assets: 6/6 hashes recomputed from both platforms with hash-asset, all equal.
• Real scans: 6/6 scanners completed a network-none scan through the production adapter on the published amd64 bases, with no coverage gaps.

Fixes the first cso-scanner-images.yml run needed

• Redaction no longer discards OSV/Trivy reports. Advisory URLs (ntap-20210312-0006) read as phone numbers and four-part versions as IP addresses, which made runProcess withhold both channels. Scanner captures now opt into redaction: 'splice': each located span becomes a <REDACTED-…> marker, and the result is released only when every view (each channel, both concatenation orders and the chronological interleaving) re-scans clean. A span split across stdout and stderr, or one that can't be located, still withholds everything.
• Schemathesis scans finish. 4.26+ fuzzes until --max-time is spent, and the adapter passed the full deadline, so CSO always killed it. The budget is now 75% of the deadline, and stop_reason: max_time counts as complete only when every selected operation ran.
• test/cso-scanner-docker-integration.test.ts fixture.
  • It now writes to snapshot/, which is what the executor mounts. Every scanner previously hit ENOENT.
  • Its lockfile declares lodash@4.17.20. Before, OSV exited 128 on an empty lockfile, and neither OSV nor Trivy exercised its database.
• test/cso-scanner-release.test.ts accepts either the empty placeholder or a complete reviewed matrix, which scannerBuildMatrix validates.

Validation

• bun run typecheck and bun run format:cso:check pass.
• All 46 test/cso-*.test.ts files pass locally on Bun 1.4.0, with new tests for splice redaction and Schemathesis completion.
• The full free suite (bun run test:ubicloud) passes: 9/9 shards.
• The containment suite passes with GSTACK_CSO_DOCKER_TESTS=1.

After merge

Dispatch cso-scanner-images.yml on main with promote_catalog=true, which needs approval of the cso-scanner-release environment. The first run may stop at the public-package check until the new cso-scanners/* GHCR packages are public. Until the resulting catalog PR merges, scans still report not assessed.

[trunk-io]

😎 This pull request was merged.

[github-actions]

E2E Evals: ✅ PASS

[test:paid] VERDICT GREEN — lane gate/pr, attempt 1
  rule 0/0 · behavior 0/0 · judge 0/0 · quarantined 0 (0 failing the lane)
  SKIPPED 0 · INFRA 0 · INCOMPLETE 0 · unattributed 0 · ACTION REQUIRED 0
  wall 0m00s · cost $0.00

0 executed, 0 reused rule/judge records | 0 manual accepted (unscored; no score-cache credit) | $0 rule/judge cost | reconcile exit: 0

Profile: pr / pr; selected behaviors: 0, judges: 0. Deferred to scheduled/release coverage: 3 behaviors and 0 changed prompt files. Deferred checks did not run and receive no PR-pass credit.

Rule and judge shards

Shard	Automated result	Manual/unscored	Executed	Reused	Status	Cost

Fail-closed reconciliation

[test:paid] report: 1/1 slices, 0 planned shards, tier=gate, attempt 1
[test:paid] coverage: profile=pr mode=pr; selected E2E=0, judges=0
[test:paid] deferred: 3 broad behaviors, 0 changed prompts without quick live coverage; these are not PR passes
[test:paid] collector final outcomes: 0 executed, 0 reused; 0 passed, 0 failed, 0 manual accepted (unscored; no score-cache credit) (0 attempt records from 0 collectors; every record counts)
[test:paid] VERDICT GREEN — lane gate/pr, attempt 1
  rule 0/0 · behavior 0/0 · judge 0/0 · quarantined 0 (0 failing the lane)
  SKIPPED 0 · INFRA 0 · INCOMPLETE 0 · unattributed 0 · ACTION REQUIRED 0
  wall 0m00s · cost $0.00
[test:paid] report: every planned shard accounted and passed

---

Sliced lane: planner → duration-packed executors → fail-closed report. Behavior cases run a pre-registered 3-trial panel (PASS at 2/3 with no contract violation); a PASS 2/3 is shown with its failed trial, never as a clean pass. Reused results retain their original provenance and expiry.