chore(docker): quiet scanner self-match noise, keep OS packages current (#44124)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

.grype.yaml

@@ -0,0 +1,39 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Grype config for the container image scan in .github/workflows/docker.yml
+# (job: docker-build, step: "Scan built image for vulnerabilities").
+#
+# The image bundles this project's own dev build as the "apache-superset"
+# package, installed from source with version "0.0.0.dev0" rather than a
+# real released version. Grype cannot compare that placeholder against a
+# fixed-version threshold, so it treats every historical apache-superset
+# GHSA/CVE ever published as still unfixed -- 61 false positives confirmed
+# locally against this exact package metadata, spanning every severity up
+# to Critical. This excludes the paths where that self-referential package
+# metadata lives inside the image so Grype does not attempt to match
+# vulnerabilities against our own package at all; every other package in
+# the image is unaffected and still scanned normally.
+#
+# Trade-off: a genuinely vulnerable dependency pinned in this project's own
+# source (rather than an OS/Python package elsewhere in the image) is now
+# invisible to this particular scan too, not just the false positives. That
+# gap is covered by dependency scanning against the source tree itself
+# (e.g. Dependabot), which this exclusion does not affect.
+exclude:
+  - "**/apache_superset-*.dist-info/**"
+  - "**/apache_superset.egg-info/**"

docker/apt-install.sh

@@ -38,6 +38,14 @@ RESET='\033[0m'
 echo -e "${GREEN}Updating package lists...${RESET}"
 apt-get update -qq
 
+# The base image's already-installed packages can lag behind the latest
+# point release available in its own configured repos between rebuilds of
+# that image tag. Applying available updates at build time, not just
+# whatever shipped with the base image, keeps every already-installed
+# package current too, not only the ones this call adds.
+echo -e "${GREEN}Applying available package updates...${RESET}"
+apt-get upgrade -yqq
+
 echo -e "${GREEN}Installing packages: $*${RESET}"
 apt-get install -yqq --no-install-recommends "$@"
 

scripts/change_detector.py

@@ -61,6 +61,7 @@ PATTERNS = {
         r"^Dockerfile$",
         r"^docker.*",
         r"^\.github/workflows/docker\.yml$",
+        r"^\.grype\.yaml$",
     ],
     "docs": [
         r"^docs/",

tests/unit_tests/scripts/change_detector_test.py

@@ -176,3 +176,13 @@ def test_docker_workflow_changes_trigger_docker_build() -> None:
         [".github/workflows/docker.yml"],
         change_detector.PATTERNS["docker"],
     )
+
+
+def test_grype_config_changes_trigger_docker_build() -> None:
+    """A change to only `.grype.yaml` (the vulnerability-scan config) must
+    still be classified as "docker", or an accidental broad exclusion in it
+    goes unexercised by CI until it reaches master."""
+    assert change_detector.detect_changes(
+        [".grype.yaml"],
+        change_detector.PATTERNS["docker"],
+    )