[ccf-lisa]

Makes all three images pass CI's image check (no fixable HIGH or CRITICAL finding).

What changed

agent (Dockerfile)

• Builds concom with CGO_ENABLED=0, as .goreleaser.yaml already does. The agent has no import "C" and no sqlite, and CCF's plugins are built CGO_ENABLED=0 too.
• Final stage moves from gcr.io/distroless/base-debian12 to gcr.io/distroless/static-debian12:latest@sha256:d75cdd72…. A static Go binary never loads libssl, and distroless/static has no libc or libssl. That removes the 5 libssl3 3.0.20 findings, which Google hasn't rebuilt base-debian12 to fix.
• WORKDIR /app, /app/concom and CMD are unchanged, so agent-action can still copy /app/concom out of this image. The image still runs as root, as before.

agent-custodian (Dockerfile-custodian)

• Bumps c7n to 0.9.52.0@sha256:44cb9106…. This is the same line as Renovate's chore(deps): update all non-major dependencies #143.
• c7n's image has a uv-managed venv (/src/.venv) and no pip. A RUN --mount=from=ghcr.io/astral-sh/uv:0.13.6@sha256:… (Renovate tracks this form) upgrades only the flagged packages to their fixed versions: aiohttp==3.14.4, certifi==2026.10.19, oauthlib==4.0.0, pyjwt==2.15.0 and urllib3==2.8.0. uv also moved yarl 1.24.5 to 1.25.1 for aiohttp. certifi is 10.19 rather than 10.18 because PYSEC-2026-4320 lists 10.19 as the fix.
• Purges Ubuntu's python3-pip-whl and python3-setuptools-whl, which hold the pip 24.0 and setuptools 68.1.2 findings. They are only the ensurepip wheels for python3 -m venv, so the purge also removes python3-venv and python3.12-venv. c7n's own venv is unaffected.
• concom is built CGO_ENABLED=0, so it no longer depends on the c7n image's Ubuntu glibc, which is older than the Debian builder's. The patch block comes after COPY --from=builder so that this file merges cleanly with chore(deps): update all non-major dependencies #143.
• Drop each pin once a c7n release ships that version or newer.

agent-ci (Dockerfile-ci): only adds CGO_ENABLED=0, so all three images ship the same static binary. The base is unchanged.

Image check (image-scan check, workflows main 6bcaa73, osv-scanner v2.7.0), fixable HIGH/CRITICAL

Image	main	this PR
agent	5 (libssl3)	0 (1 other, unfixable)
agent-custodian	32 on c7n 0.9.49.0 (18 on 0.9.52.0 unpatched)	0 (5 other: 3 MEDIUM, 1 LOW, 1 UNKNOWN)
agent-ci	0	0

Runtime checks (local docker builds)

• agent: the binary is statically linked (per file), and concom --help runs in distroless/static. concom download-plugin -s ghcr.io/compliance-framework/plugin-local-ssh:latest pulls over TLS using distroless's CA bundle and Go's resolver. The downloaded plugin runs in the same image and prints the "This binary is a plugin" banner.
• agent-custodian: runs as user custodian, as before. custodian version prints 0.9.52 and custodian validate passes on a small AWS policy. custodian run --dryrun runs under moto's mock_aws with no network, and both policies match one resource each, the same as the unpatched 0.9.52.0 image. uv pip check reports all installed packages compatible (242). Every c7n provider loads (aws, azure, gcp, k8s, oci, …), and so do msal, requests_oauthlib and kubernetes. concom --help runs.
• agent-ci: concom --help runs.
• gofmt -l . is clean and go test ./... passes (go1.26.10 before the merge, go1.27.3 after it). There are no Go changes. hadolint on the custodian file reports only DL3066 (info) for USER root/USER custodian, and the agent file's DL3006 warning on main is gone.

Merged with main (after #143)

#143 has merged, and this branch now has main merged in (511f32c, a merge commit). The one conflict was the final FROM line of Dockerfile: the merge keeps this PR's static-debian12 line and drops #143's base-debian12 digest pin. Everything else comes from main as is: the golang:1.27.3@sha256:… builder lines, toolchain go1.27.3, c7n 0.9.52.0@sha256:… (already the same line here), the digest-pinned debian:bookworm-slim in Dockerfile-ci, and the re-gofmt'd types.pb.go. CGO_ENABLED=0 stays on all three builds.

Re-checked after the merge, under go1.27.3: gofmt -l . is clean, go vet ./... and go test ./... pass, and go mod tidy leaves no diff. All three images rebuilt locally and image-scan check (workflows main e5482ec) reports no fixable HIGH or CRITICAL finding for agent, agent-ci and agent-custodian. concom --help runs in the agent image and custodian version prints 0.9.52 in the custodian image.

Before merging

Please run stack-smoke.yml on images built from this branch. The agent image's base changed, and the custodian image's Python dependencies moved, including oauthlib 3 to 4.

Open questions for reviewers

• A third-party plugin linked dynamically against libc would no longer run in the agent image. CCF's plugins are static, and agent-ci (Debian) and agent-custodian (Ubuntu) still have libc. Is that acceptable, or should it be called out in the release notes?

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1d254896-8ea3-42bf-a1a5-dca96e9d5ce3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

Approved: static agent on distroless/static-debian12, patched custodian venv, CGO off everywhere; required and all three image checks green.