{"owner":"gitpod-io","repo":"gitpod","hasSkills":true,"totalSkillsCount":2,"totalTokensCount":2254,"categories":["root-instruction","anthropic-skill"],"hasMcp":false,"mcpConfig":null,"found":["AGENTS.md","cve-mitigation/SKILL.md"],"skills":{"AGENTS.md":"# Gitpod repository guidance\n\nGitpod is a multi-language monorepo for a Kubernetes-based development\nenvironment platform. Keep changes focused: identify the component or workflow\nyou are changing and read its local documentation before editing it.\n\n## Task-specific context\n\n- For CVE remediation and daily vulnerability scan work, read\n  `cve-mitigation/SKILL.md` and `cve-mitigation/references/ci-scanning.md`.\n- For changes to the development image or tools installed in it, read\n  `dev/image/README.md`.\n- Consult component-specific documentation only when working in that component.\n  Do not read or update the entire `memory-bank/` for every task.\n\n## Working conventions\n\n- Preserve unrelated changes already present in the worktree.\n- `.github/workflows/build.yml` and `.github/workflows/branch-build.yml` mirror\n  many build steps. Changes to shared build behavior normally belong in both.\n- Run the smallest relevant test suite for the code you changed.\n- Run `pre-commit run --files <changed files>` before submitting a change.\n","cve-mitigation/SKILL.md":"---\nname: cve-mitigation\ndescription: >\n  Scan, triage, and remediate CVEs in the Gitpod monorepo. Use when asked to\n  fix vulnerabilities, update dependencies for security, respond to CVE scan\n  failures, or validate that dependency updates resolve known CVEs. Triggers on\n  \"fix CVE\", \"vulnerability scan\", \"security update\", \"dependency CVE\",\n  \"grype scan\", \"leeway sbom\", \"CVE remediation\", \"update vulnerable dependency\",\n  \"daily scan failure\", \"critical vulnerability\".\n---\n\n# CVE Mitigation\n\nFix and validate CVE findings in the Gitpod monorepo. This repo has ~80 Go modules\nunder `components/`, `dev/`, `install/`, and `test/`, plus TypeScript/Node packages.\n\n## Scanning\n\n### Fast local scan (grype)\n\nInstall grype if missing, then scan individual modules or the whole repo:\n\n```bash\n# Install grype (one-time)\ncurl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin\n\n# Scan a single module (fastest — ~2s per module)\ngrype file:components/common-go/go.mod --only-fixed --output table\n\n# Scan a single module directory (slower — ~40s, also picks up binaries/lockfiles)\ngrype dir:components/common-go --only-fixed --output table\n\n# JSON output for programmatic use\ngrype file:components/common-go/go.mod --only-fixed --output json 2>/dev/null | \\\n  jq '[.matches[] | {id: .vulnerability.id, severity: .vulnerability.severity, package: .artifact.name, installed: .artifact.version, fixedIn: .vulnerability.fix.versions}]'\n\n# Scan all Go modules, show only Critical/High with fixes available\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\;\n```\n\nUse `--fail-on critical` or `--fail-on high` to get a non-zero exit code.\n\n### CI scan (leeway sbom)\n\nCI uses `leeway sbom export` + `leeway sbom scan` against `components:needs-vuln-scan`.\nLeeway embeds both syft (SBOM generation) and grype (vulnerability matching) internally.\nThe CI scan is slow (requires full build cache) and runs on every push to `main` and on PRs.\n\nThe daily scheduled run (`build.yml`, cron `0 0 * * *`) checks `vulnerability-stats.json`\nfor critical counts and sends Slack alerts via `notify-scheduled-failure`.\n\nRead `references/ci-scanning.md` for the full CI pipeline details.\n\n### Trivy image scanning\n\nA separate Trivy-based scan (`scripts/trivy/trivy-scan-images.sh`) scans built Docker\nimages. It uses `scripts/trivy/trivyignore.yaml` for suppressions. This is distinct from\nthe Go dependency scanning.\n\n## Triage\n\nWhen a CVE is reported:\n\n1. **Check severity and CVSS score.** Focus on Critical (CVSS ≥ 9.0) and High (CVSS ≥ 7.0) first.\n2. **Check if a fix exists.** Use `--only-fixed` with grype. If no fix exists, document and defer.\n3. **Check exploitability in context.** Not all CVEs are exploitable in Gitpod's usage. If a CVE\n   is a false positive or not exploitable, add it to `WORKSPACE.yaml` under `sbom.ignoreVulnerabilities`\n   with a `vulnerability` ID and a `reason` explaining why.\n4. **Check for breaking API changes.** Some upgrades (e.g., `runc` v1.1.x → v1.2.x) change\n   exported APIs. These require code migration, not just `go get`.\n\n## BuildKit fork updates\n\nThe image-builder-bob component depends on Gitpod's BuildKit fork. Follow the\n[fork maintenance procedure](references/buildkit.md) to update it with upstream\nwhile preserving Gitpod's customizations.\n\n## Remediation (Go dependencies)\n\n### Standard update flow\n\nFor each affected module:\n\n```bash\ncd components/<module>\n\n# Update a specific dependency\ngo get google.golang.org/grpc@v1.79.3\n\n# Update transitive dependencies that need bumping\ngo get golang.org/x/net@latest\n\n# Clean up\ngo mod tidy\n\n# Verify it builds\ngo build ./...\n```\n\n### Multi-module coordination\n\nThis repo has many Go modules that share dependencies via `replace` directives in `go.mod`.\nWhen updating a dependency:\n\n1. **Start with leaf modules** (APIs, protocol packages) and work up to service modules.\n2. **Check replace directives.** Many modules use `replace` to point to local paths:\n   ```\n   replace github.com/gitpod-io/gitpod/common-go => ../common-go // leeway\n   ```\n   If `common-go` bumps a dependency, all modules that replace-reference it will\n   transitively pick up the new version.\n3. **Update all modules that directly depend on the vulnerable package.** Use:\n   ```bash\n   grep -rl \"google.golang.org/grpc\" components/*/go.mod | sort\n   ```\n4. **Don't forget `dev/` and `test/` modules.** CI builds these too. They often lag behind.\n5. **Run `go mod tidy` in every updated module.** Missing this causes CI failures.\n\n### OpenTelemetry replace directives\n\nSome modules (notably `image-builder-bob`) use `replace` directives to pin OpenTelemetry\nversions. When upgrading grpc, the OTel SDK version requirements may change. Update the\nreplace directives to match:\n\n```go\nreplace (\n    go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.39.0\n    go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.39.0\n    // ... etc\n)\n```\n\n### Deprecated package migration\n\nWhen a package is deprecated and replaced (e.g., `dgrijalva/jwt-go` → `golang-jwt/jwt/v5`):\n\n1. Update `go.mod`: remove old dependency, add new one.\n2. Update import paths in `.go` files.\n3. Verify API compatibility — most maintained forks keep the same API surface.\n4. Run `go build ./...` and `go test ./...` to confirm.\n\n### Packages with breaking changes\n\nSome upgrades cannot be done with a simple version bump. Document these in the PR\nunder \"Not addressed (requires follow-up)\" with the specific breaking change.\nExample: `opencontainers/runc` v1.1.x → v1.2.x made `libcontainer/cgroups/ebpf`\nfunctions unexported.\n\n## Suppressing false positives\n\nTwo suppression mechanisms exist:\n\n### WORKSPACE.yaml (leeway sbom scan)\n\nAdd entries under `sbom.ignoreVulnerabilities` in `WORKSPACE.yaml`:\n\n```yaml\nsbom:\n  enabled: true\n  ignoreVulnerabilities:\n    - vulnerability: GHSA-xxxx-xxxx-xxxx\n      reason: |\n        Explanation of why this CVE is not exploitable in Gitpod's usage.\n```\n\n### Trivy ignore (image scanning)\n\nAdd entries to `scripts/trivy/trivyignore.yaml`:\n\n```yaml\nvulnerabilities:\n  - id: CVE-YYYY-NNNNN\n    paths:\n      - \"app/node_modules/package/package.json\"\n    statement: |\n      Explanation.\n```\n\n## Validation\n\nAfter making changes, validate locally before pushing:\n\n```bash\n# Quick: scan only the modules you changed\ngrype file:components/<module>/go.mod --only-fixed --output table\n\n# Thorough: scan all components\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\; \\\n  2>&1 | grep -E \"^===|Critical|High\"\n\n# Build verification for key modules\nfor mod in common-go supervisor public-api-server ws-proxy ws-manager-mk2 \\\n           registry-facade blobserve content-service image-builder-mk3 \\\n           gitpod-cli local-app ide-metrics ide-service node-labeler \\\n           openvsx-proxy service-waiter ws-daemon image-builder-bob usage; do\n  echo \"=== Building components/$mod ===\" && \\\n  (cd \"components/$mod\" && go build ./...) || echo \"FAILED: $mod\"\ndone\n```\n\n## PR conventions\n\n- Title: \"Fix critical CVEs from daily vulnerability scan\" or similar.\n- Body: Include a table of updated packages with From/To versions and CVE IDs.\n- Tag with `team: staff-engineers` and `team: team-enterprise`.\n- Reference the Linear issue (e.g., \"Fixes: CLC-XXXX\").\n- List any CVEs that could NOT be addressed and why under \"Not addressed (requires follow-up)\".\n- Co-author: `Co-authored-by: Ona <no-reply@ona.com>`\n\n## Reference files\n\n- `references/ci-scanning.md` — CI pipeline details for vulnerability scanning.\n- `references/go-modules.md` — List of all Go modules and their scan-relevant groupings.\n"},"files":{"AGENTS.md":"# Gitpod repository guidance\n\nGitpod is a multi-language monorepo for a Kubernetes-based development\nenvironment platform. Keep changes focused: identify the component or workflow\nyou are changing and read its local documentation before editing it.\n\n## Task-specific context\n\n- For CVE remediation and daily vulnerability scan work, read\n  `cve-mitigation/SKILL.md` and `cve-mitigation/references/ci-scanning.md`.\n- For changes to the development image or tools installed in it, read\n  `dev/image/README.md`.\n- Consult component-specific documentation only when working in that component.\n  Do not read or update the entire `memory-bank/` for every task.\n\n## Working conventions\n\n- Preserve unrelated changes already present in the worktree.\n- `.github/workflows/build.yml` and `.github/workflows/branch-build.yml` mirror\n  many build steps. Changes to shared build behavior normally belong in both.\n- Run the smallest relevant test suite for the code you changed.\n- Run `pre-commit run --files <changed files>` before submitting a change.\n","cve-mitigation/SKILL.md":"---\nname: cve-mitigation\ndescription: >\n  Scan, triage, and remediate CVEs in the Gitpod monorepo. Use when asked to\n  fix vulnerabilities, update dependencies for security, respond to CVE scan\n  failures, or validate that dependency updates resolve known CVEs. Triggers on\n  \"fix CVE\", \"vulnerability scan\", \"security update\", \"dependency CVE\",\n  \"grype scan\", \"leeway sbom\", \"CVE remediation\", \"update vulnerable dependency\",\n  \"daily scan failure\", \"critical vulnerability\".\n---\n\n# CVE Mitigation\n\nFix and validate CVE findings in the Gitpod monorepo. This repo has ~80 Go modules\nunder `components/`, `dev/`, `install/`, and `test/`, plus TypeScript/Node packages.\n\n## Scanning\n\n### Fast local scan (grype)\n\nInstall grype if missing, then scan individual modules or the whole repo:\n\n```bash\n# Install grype (one-time)\ncurl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin\n\n# Scan a single module (fastest — ~2s per module)\ngrype file:components/common-go/go.mod --only-fixed --output table\n\n# Scan a single module directory (slower — ~40s, also picks up binaries/lockfiles)\ngrype dir:components/common-go --only-fixed --output table\n\n# JSON output for programmatic use\ngrype file:components/common-go/go.mod --only-fixed --output json 2>/dev/null | \\\n  jq '[.matches[] | {id: .vulnerability.id, severity: .vulnerability.severity, package: .artifact.name, installed: .artifact.version, fixedIn: .vulnerability.fix.versions}]'\n\n# Scan all Go modules, show only Critical/High with fixes available\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\;\n```\n\nUse `--fail-on critical` or `--fail-on high` to get a non-zero exit code.\n\n### CI scan (leeway sbom)\n\nCI uses `leeway sbom export` + `leeway sbom scan` against `components:needs-vuln-scan`.\nLeeway embeds both syft (SBOM generation) and grype (vulnerability matching) internally.\nThe CI scan is slow (requires full build cache) and runs on every push to `main` and on PRs.\n\nThe daily scheduled run (`build.yml`, cron `0 0 * * *`) checks `vulnerability-stats.json`\nfor critical counts and sends Slack alerts via `notify-scheduled-failure`.\n\nRead `references/ci-scanning.md` for the full CI pipeline details.\n\n### Trivy image scanning\n\nA separate Trivy-based scan (`scripts/trivy/trivy-scan-images.sh`) scans built Docker\nimages. It uses `scripts/trivy/trivyignore.yaml` for suppressions. This is distinct from\nthe Go dependency scanning.\n\n## Triage\n\nWhen a CVE is reported:\n\n1. **Check severity and CVSS score.** Focus on Critical (CVSS ≥ 9.0) and High (CVSS ≥ 7.0) first.\n2. **Check if a fix exists.** Use `--only-fixed` with grype. If no fix exists, document and defer.\n3. **Check exploitability in context.** Not all CVEs are exploitable in Gitpod's usage. If a CVE\n   is a false positive or not exploitable, add it to `WORKSPACE.yaml` under `sbom.ignoreVulnerabilities`\n   with a `vulnerability` ID and a `reason` explaining why.\n4. **Check for breaking API changes.** Some upgrades (e.g., `runc` v1.1.x → v1.2.x) change\n   exported APIs. These require code migration, not just `go get`.\n\n## BuildKit fork updates\n\nThe image-builder-bob component depends on Gitpod's BuildKit fork. Follow the\n[fork maintenance procedure](references/buildkit.md) to update it with upstream\nwhile preserving Gitpod's customizations.\n\n## Remediation (Go dependencies)\n\n### Standard update flow\n\nFor each affected module:\n\n```bash\ncd components/<module>\n\n# Update a specific dependency\ngo get google.golang.org/grpc@v1.79.3\n\n# Update transitive dependencies that need bumping\ngo get golang.org/x/net@latest\n\n# Clean up\ngo mod tidy\n\n# Verify it builds\ngo build ./...\n```\n\n### Multi-module coordination\n\nThis repo has many Go modules that share dependencies via `replace` directives in `go.mod`.\nWhen updating a dependency:\n\n1. **Start with leaf modules** (APIs, protocol packages) and work up to service modules.\n2. **Check replace directives.** Many modules use `replace` to point to local paths:\n   ```\n   replace github.com/gitpod-io/gitpod/common-go => ../common-go // leeway\n   ```\n   If `common-go` bumps a dependency, all modules that replace-reference it will\n   transitively pick up the new version.\n3. **Update all modules that directly depend on the vulnerable package.** Use:\n   ```bash\n   grep -rl \"google.golang.org/grpc\" components/*/go.mod | sort\n   ```\n4. **Don't forget `dev/` and `test/` modules.** CI builds these too. They often lag behind.\n5. **Run `go mod tidy` in every updated module.** Missing this causes CI failures.\n\n### OpenTelemetry replace directives\n\nSome modules (notably `image-builder-bob`) use `replace` directives to pin OpenTelemetry\nversions. When upgrading grpc, the OTel SDK version requirements may change. Update the\nreplace directives to match:\n\n```go\nreplace (\n    go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.39.0\n    go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.39.0\n    // ... etc\n)\n```\n\n### Deprecated package migration\n\nWhen a package is deprecated and replaced (e.g., `dgrijalva/jwt-go` → `golang-jwt/jwt/v5`):\n\n1. Update `go.mod`: remove old dependency, add new one.\n2. Update import paths in `.go` files.\n3. Verify API compatibility — most maintained forks keep the same API surface.\n4. Run `go build ./...` and `go test ./...` to confirm.\n\n### Packages with breaking changes\n\nSome upgrades cannot be done with a simple version bump. Document these in the PR\nunder \"Not addressed (requires follow-up)\" with the specific breaking change.\nExample: `opencontainers/runc` v1.1.x → v1.2.x made `libcontainer/cgroups/ebpf`\nfunctions unexported.\n\n## Suppressing false positives\n\nTwo suppression mechanisms exist:\n\n### WORKSPACE.yaml (leeway sbom scan)\n\nAdd entries under `sbom.ignoreVulnerabilities` in `WORKSPACE.yaml`:\n\n```yaml\nsbom:\n  enabled: true\n  ignoreVulnerabilities:\n    - vulnerability: GHSA-xxxx-xxxx-xxxx\n      reason: |\n        Explanation of why this CVE is not exploitable in Gitpod's usage.\n```\n\n### Trivy ignore (image scanning)\n\nAdd entries to `scripts/trivy/trivyignore.yaml`:\n\n```yaml\nvulnerabilities:\n  - id: CVE-YYYY-NNNNN\n    paths:\n      - \"app/node_modules/package/package.json\"\n    statement: |\n      Explanation.\n```\n\n## Validation\n\nAfter making changes, validate locally before pushing:\n\n```bash\n# Quick: scan only the modules you changed\ngrype file:components/<module>/go.mod --only-fixed --output table\n\n# Thorough: scan all components\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\; \\\n  2>&1 | grep -E \"^===|Critical|High\"\n\n# Build verification for key modules\nfor mod in common-go supervisor public-api-server ws-proxy ws-manager-mk2 \\\n           registry-facade blobserve content-service image-builder-mk3 \\\n           gitpod-cli local-app ide-metrics ide-service node-labeler \\\n           openvsx-proxy service-waiter ws-daemon image-builder-bob usage; do\n  echo \"=== Building components/$mod ===\" && \\\n  (cd \"components/$mod\" && go build ./...) || echo \"FAILED: $mod\"\ndone\n```\n\n## PR conventions\n\n- Title: \"Fix critical CVEs from daily vulnerability scan\" or similar.\n- Body: Include a table of updated packages with From/To versions and CVE IDs.\n- Tag with `team: staff-engineers` and `team: team-enterprise`.\n- Reference the Linear issue (e.g., \"Fixes: CLC-XXXX\").\n- List any CVEs that could NOT be addressed and why under \"Not addressed (requires follow-up)\".\n- Co-author: `Co-authored-by: Ona <no-reply@ona.com>`\n\n## Reference files\n\n- `references/ci-scanning.md` — CI pipeline details for vulnerability scanning.\n- `references/go-modules.md` — List of all Go modules and their scan-relevant groupings.\n"},"items":[{"name":"AGENTS.md","path":"AGENTS.md","rawUrl":"https://raw.githubusercontent.com/gitpod-io/gitpod/HEAD/AGENTS.md","title":"AI Agent Protocol & Instructions","category":"root-instruction","format":"markdown","content":"# Gitpod repository guidance\n\nGitpod is a multi-language monorepo for a Kubernetes-based development\nenvironment platform. Keep changes focused: identify the component or workflow\nyou are changing and read its local documentation before editing it.\n\n## Task-specific context\n\n- For CVE remediation and daily vulnerability scan work, read\n  `cve-mitigation/SKILL.md` and `cve-mitigation/references/ci-scanning.md`.\n- For changes to the development image or tools installed in it, read\n  `dev/image/README.md`.\n- Consult component-specific documentation only when working in that component.\n  Do not read or update the entire `memory-bank/` for every task.\n\n## Working conventions\n\n- Preserve unrelated changes already present in the worktree.\n- `.github/workflows/build.yml` and `.github/workflows/branch-build.yml` mirror\n  many build steps. Changes to shared build behavior normally belong in both.\n- Run the smallest relevant test suite for the code you changed.\n- Run `pre-commit run --files <changed files>` before submitting a change.\n","isInternal":false,"tokens":224,"sizeBytes":1040},{"name":"SKILL.md","path":"cve-mitigation/SKILL.md","rawUrl":"https://raw.githubusercontent.com/gitpod-io/gitpod/HEAD/cve-mitigation/SKILL.md","title":"cve-mitigation","category":"anthropic-skill","format":"markdown","content":"---\nname: cve-mitigation\ndescription: >\n  Scan, triage, and remediate CVEs in the Gitpod monorepo. Use when asked to\n  fix vulnerabilities, update dependencies for security, respond to CVE scan\n  failures, or validate that dependency updates resolve known CVEs. Triggers on\n  \"fix CVE\", \"vulnerability scan\", \"security update\", \"dependency CVE\",\n  \"grype scan\", \"leeway sbom\", \"CVE remediation\", \"update vulnerable dependency\",\n  \"daily scan failure\", \"critical vulnerability\".\n---\n\n# CVE Mitigation\n\nFix and validate CVE findings in the Gitpod monorepo. This repo has ~80 Go modules\nunder `components/`, `dev/`, `install/`, and `test/`, plus TypeScript/Node packages.\n\n## Scanning\n\n### Fast local scan (grype)\n\nInstall grype if missing, then scan individual modules or the whole repo:\n\n```bash\n# Install grype (one-time)\ncurl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin\n\n# Scan a single module (fastest — ~2s per module)\ngrype file:components/common-go/go.mod --only-fixed --output table\n\n# Scan a single module directory (slower — ~40s, also picks up binaries/lockfiles)\ngrype dir:components/common-go --only-fixed --output table\n\n# JSON output for programmatic use\ngrype file:components/common-go/go.mod --only-fixed --output json 2>/dev/null | \\\n  jq '[.matches[] | {id: .vulnerability.id, severity: .vulnerability.severity, package: .artifact.name, installed: .artifact.version, fixedIn: .vulnerability.fix.versions}]'\n\n# Scan all Go modules, show only Critical/High with fixes available\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\;\n```\n\nUse `--fail-on critical` or `--fail-on high` to get a non-zero exit code.\n\n### CI scan (leeway sbom)\n\nCI uses `leeway sbom export` + `leeway sbom scan` against `components:needs-vuln-scan`.\nLeeway embeds both syft (SBOM generation) and grype (vulnerability matching) internally.\nThe CI scan is slow (requires full build cache) and runs on every push to `main` and on PRs.\n\nThe daily scheduled run (`build.yml`, cron `0 0 * * *`) checks `vulnerability-stats.json`\nfor critical counts and sends Slack alerts via `notify-scheduled-failure`.\n\nRead `references/ci-scanning.md` for the full CI pipeline details.\n\n### Trivy image scanning\n\nA separate Trivy-based scan (`scripts/trivy/trivy-scan-images.sh`) scans built Docker\nimages. It uses `scripts/trivy/trivyignore.yaml` for suppressions. This is distinct from\nthe Go dependency scanning.\n\n## Triage\n\nWhen a CVE is reported:\n\n1. **Check severity and CVSS score.** Focus on Critical (CVSS ≥ 9.0) and High (CVSS ≥ 7.0) first.\n2. **Check if a fix exists.** Use `--only-fixed` with grype. If no fix exists, document and defer.\n3. **Check exploitability in context.** Not all CVEs are exploitable in Gitpod's usage. If a CVE\n   is a false positive or not exploitable, add it to `WORKSPACE.yaml` under `sbom.ignoreVulnerabilities`\n   with a `vulnerability` ID and a `reason` explaining why.\n4. **Check for breaking API changes.** Some upgrades (e.g., `runc` v1.1.x → v1.2.x) change\n   exported APIs. These require code migration, not just `go get`.\n\n## BuildKit fork updates\n\nThe image-builder-bob component depends on Gitpod's BuildKit fork. Follow the\n[fork maintenance procedure](references/buildkit.md) to update it with upstream\nwhile preserving Gitpod's customizations.\n\n## Remediation (Go dependencies)\n\n### Standard update flow\n\nFor each affected module:\n\n```bash\ncd components/<module>\n\n# Update a specific dependency\ngo get google.golang.org/grpc@v1.79.3\n\n# Update transitive dependencies that need bumping\ngo get golang.org/x/net@latest\n\n# Clean up\ngo mod tidy\n\n# Verify it builds\ngo build ./...\n```\n\n### Multi-module coordination\n\nThis repo has many Go modules that share dependencies via `replace` directives in `go.mod`.\nWhen updating a dependency:\n\n1. **Start with leaf modules** (APIs, protocol packages) and work up to service modules.\n2. **Check replace directives.** Many modules use `replace` to point to local paths:\n   ```\n   replace github.com/gitpod-io/gitpod/common-go => ../common-go // leeway\n   ```\n   If `common-go` bumps a dependency, all modules that replace-reference it will\n   transitively pick up the new version.\n3. **Update all modules that directly depend on the vulnerable package.** Use:\n   ```bash\n   grep -rl \"google.golang.org/grpc\" components/*/go.mod | sort\n   ```\n4. **Don't forget `dev/` and `test/` modules.** CI builds these too. They often lag behind.\n5. **Run `go mod tidy` in every updated module.** Missing this causes CI failures.\n\n### OpenTelemetry replace directives\n\nSome modules (notably `image-builder-bob`) use `replace` directives to pin OpenTelemetry\nversions. When upgrading grpc, the OTel SDK version requirements may change. Update the\nreplace directives to match:\n\n```go\nreplace (\n    go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.39.0\n    go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.39.0\n    // ... etc\n)\n```\n\n### Deprecated package migration\n\nWhen a package is deprecated and replaced (e.g., `dgrijalva/jwt-go` → `golang-jwt/jwt/v5`):\n\n1. Update `go.mod`: remove old dependency, add new one.\n2. Update import paths in `.go` files.\n3. Verify API compatibility — most maintained forks keep the same API surface.\n4. Run `go build ./...` and `go test ./...` to confirm.\n\n### Packages with breaking changes\n\nSome upgrades cannot be done with a simple version bump. Document these in the PR\nunder \"Not addressed (requires follow-up)\" with the specific breaking change.\nExample: `opencontainers/runc` v1.1.x → v1.2.x made `libcontainer/cgroups/ebpf`\nfunctions unexported.\n\n## Suppressing false positives\n\nTwo suppression mechanisms exist:\n\n### WORKSPACE.yaml (leeway sbom scan)\n\nAdd entries under `sbom.ignoreVulnerabilities` in `WORKSPACE.yaml`:\n\n```yaml\nsbom:\n  enabled: true\n  ignoreVulnerabilities:\n    - vulnerability: GHSA-xxxx-xxxx-xxxx\n      reason: |\n        Explanation of why this CVE is not exploitable in Gitpod's usage.\n```\n\n### Trivy ignore (image scanning)\n\nAdd entries to `scripts/trivy/trivyignore.yaml`:\n\n```yaml\nvulnerabilities:\n  - id: CVE-YYYY-NNNNN\n    paths:\n      - \"app/node_modules/package/package.json\"\n    statement: |\n      Explanation.\n```\n\n## Validation\n\nAfter making changes, validate locally before pushing:\n\n```bash\n# Quick: scan only the modules you changed\ngrype file:components/<module>/go.mod --only-fixed --output table\n\n# Thorough: scan all components\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\; \\\n  2>&1 | grep -E \"^===|Critical|High\"\n\n# Build verification for key modules\nfor mod in common-go supervisor public-api-server ws-proxy ws-manager-mk2 \\\n           registry-facade blobserve content-service image-builder-mk3 \\\n           gitpod-cli local-app ide-metrics ide-service node-labeler \\\n           openvsx-proxy service-waiter ws-daemon image-builder-bob usage; do\n  echo \"=== Building components/$mod ===\" && \\\n  (cd \"components/$mod\" && go build ./...) || echo \"FAILED: $mod\"\ndone\n```\n\n## PR conventions\n\n- Title: \"Fix critical CVEs from daily vulnerability scan\" or similar.\n- Body: Include a table of updated packages with From/To versions and CVE IDs.\n- Tag with `team: staff-engineers` and `team: team-enterprise`.\n- Reference the Linear issue (e.g., \"Fixes: CLC-XXXX\").\n- List any CVEs that could NOT be addressed and why under \"Not addressed (requires follow-up)\".\n- Co-author: `Co-authored-by: Ona <no-reply@ona.com>`\n\n## Reference files\n\n- `references/ci-scanning.md` — CI pipeline details for vulnerability scanning.\n- `references/go-modules.md` — List of all Go modules and their scan-relevant groupings.\n","frontmatter":{"name":"cve-mitigation","description":"Scan, triage, and remediate CVEs in the Gitpod monorepo. Use when asked to fix vulnerabilities, update dependencies for security, respond to CVE scan failures, or validate that dependency updates resolve known CVEs. Triggers on \"fix CVE\", \"vulnerability scan\", \"security update\", \"dependency CVE\", \"grype scan\", \"leeway sbom\", \"CVE remediation\", \"update vulnerable dependency\", \"daily scan failure\", \"critical vulnerability\".\n"},"isInternal":false,"tokens":2030,"sizeBytes":7808}],"systemPromptSnippet":"<yakaai_skills repo=\"gitpod-io/gitpod\">\n<!-- File: AGENTS.md (Tokens: ~224 | Category: root-instruction) -->\n# Gitpod repository guidance\n\nGitpod is a multi-language monorepo for a Kubernetes-based development\nenvironment platform. Keep changes focused: identify the component or workflow\nyou are changing and read its local documentation before editing it.\n\n## Task-specific context\n\n- For CVE remediation and daily vulnerability scan work, read\n  `cve-mitigation/SKILL.md` and `cve-mitigation/references/ci-scanning.md`.\n- For changes to the development image or tools installed in it, read\n  `dev/image/README.md`.\n- Consult component-specific documentation only when working in that component.\n  Do not read or update the entire `memory-bank/` for every task.\n\n## Working conventions\n\n- Preserve unrelated changes already present in the worktree.\n- `.github/workflows/build.yml` and `.github/workflows/branch-build.yml` mirror\n  many build steps. Changes to shared build behavior normally belong in both.\n- Run the smallest relevant test suite for the code you changed.\n- Run `pre-commit run --files <changed files>` before submitting a change.\n\n<!-- File: cve-mitigation/SKILL.md (Tokens: ~2030 | Category: anthropic-skill) -->\n---\nname: cve-mitigation\ndescription: >\n  Scan, triage, and remediate CVEs in the Gitpod monorepo. Use when asked to\n  fix vulnerabilities, update dependencies for security, respond to CVE scan\n  failures, or validate that dependency updates resolve known CVEs. Triggers on\n  \"fix CVE\", \"vulnerability scan\", \"security update\", \"dependency CVE\",\n  \"grype scan\", \"leeway sbom\", \"CVE remediation\", \"update vulnerable dependency\",\n  \"daily scan failure\", \"critical vulnerability\".\n---\n\n# CVE Mitigation\n\nFix and validate CVE findings in the Gitpod monorepo. This repo has ~80 Go modules\nunder `components/`, `dev/`, `install/`, and `test/`, plus TypeScript/Node packages.\n\n## Scanning\n\n### Fast local scan (grype)\n\nInstall grype if missing, then scan individual modules or the whole repo:\n\n```bash\n# Install grype (one-time)\ncurl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin\n\n# Scan a single module (fastest — ~2s per module)\ngrype file:components/common-go/go.mod --only-fixed --output table\n\n# Scan a single module directory (slower — ~40s, also picks up binaries/lockfiles)\ngrype dir:components/common-go --only-fixed --output table\n\n# JSON output for programmatic use\ngrype file:components/common-go/go.mod --only-fixed --output json 2>/dev/null | \\\n  jq '[.matches[] | {id: .vulnerability.id, severity: .vulnerability.severity, package: .artifact.name, installed: .artifact.version, fixedIn: .vulnerability.fix.versions}]'\n\n# Scan all Go modules, show only Critical/High with fixes available\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\;\n```\n\nUse `--fail-on critical` or `--fail-on high` to get a non-zero exit code.\n\n### CI scan (leeway sbom)\n\nCI uses `leeway sbom export` + `leeway sbom scan` against `components:needs-vuln-scan`.\nLeeway embeds both syft (SBOM generation) and grype (vulnerability matching) internally.\nThe CI scan is slow (requires full build cache) and runs on every push to `main` and on PRs.\n\nThe daily scheduled run (`build.yml`, cron `0 0 * * *`) checks `vulnerability-stats.json`\nfor critical counts and sends Slack alerts via `notify-scheduled-failure`.\n\nRead `references/ci-scanning.md` for the full CI pipeline details.\n\n### Trivy image scanning\n\nA separate Trivy-based scan (`scripts/trivy/trivy-scan-images.sh`) scans built Docker\nimages. It uses `scripts/trivy/trivyignore.yaml` for suppressions. This is distinct from\nthe Go dependency scanning.\n\n## Triage\n\nWhen a CVE is reported:\n\n1. **Check severity and CVSS score.** Focus on Critical (CVSS ≥ 9.0) and High (CVSS ≥ 7.0) first.\n2. **Check if a fix exists.** Use `--only-fixed` with grype. If no fix exists, document and defer.\n3. **Check exploitability in context.** Not all CVEs are exploitable in Gitpod's usage. If a CVE\n   is a false positive or not exploitable, add it to `WORKSPACE.yaml` under `sbom.ignoreVulnerabilities`\n   with a `vulnerability` ID and a `reason` explaining why.\n4. **Check for breaking API changes.** Some upgrades (e.g., `runc` v1.1.x → v1.2.x) change\n   exported APIs. These require code migration, not just `go get`.\n\n## BuildKit fork updates\n\nThe image-builder-bob component depends on Gitpod's BuildKit fork. Follow the\n[fork maintenance procedure](references/buildkit.md) to update it with upstream\nwhile preserving Gitpod's customizations.\n\n## Remediation (Go dependencies)\n\n### Standard update flow\n\nFor each affected module:\n\n```bash\ncd components/<module>\n\n# Update a specific dependency\ngo get google.golang.org/grpc@v1.79.3\n\n# Update transitive dependencies that need bumping\ngo get golang.org/x/net@latest\n\n# Clean up\ngo mod tidy\n\n# Verify it builds\ngo build ./...\n```\n\n### Multi-module coordination\n\nThis repo has many Go modules that share dependencies via `replace` directives in `go.mod`.\nWhen updating a dependency:\n\n1. **Start with leaf modules** (APIs, protocol packages) and work up to service modules.\n2. **Check replace directives.** Many modules use `replace` to point to local paths:\n   ```\n   replace github.com/gitpod-io/gitpod/common-go => ../common-go // leeway\n   ```\n   If `common-go` bumps a dependency, all modules that replace-reference it will\n   transitively pick up the new version.\n3. **Update all modules that directly depend on the vulnerable package.** Use:\n   ```bash\n   grep -rl \"google.golang.org/grpc\" components/*/go.mod | sort\n   ```\n4. **Don't forget `dev/` and `test/` modules.** CI builds these too. They often lag behind.\n5. **Run `go mod tidy` in every updated module.** Missing this causes CI failures.\n\n### OpenTelemetry replace directives\n\nSome modules (notably `image-builder-bob`) use `replace` directives to pin OpenTelemetry\nversions. When upgrading grpc, the OTel SDK version requirements may change. Update the\nreplace directives to match:\n\n```go\nreplace (\n    go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.39.0\n    go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.39.0\n    // ... etc\n)\n```\n\n### Deprecated package migration\n\nWhen a package is deprecated and replaced (e.g., `dgrijalva/jwt-go` → `golang-jwt/jwt/v5`):\n\n1. Update `go.mod`: remove old dependency, add new one.\n2. Update import paths in `.go` files.\n3. Verify API compatibility — most maintained forks keep the same API surface.\n4. Run `go build ./...` and `go test ./...` to confirm.\n\n### Packages with breaking changes\n\nSome upgrades cannot be done with a simple version bump. Document these in the PR\nunder \"Not addressed (requires follow-up)\" with the specific breaking change.\nExample: `opencontainers/runc` v1.1.x → v1.2.x made `libcontainer/cgroups/ebpf`\nfunctions unexported.\n\n## Suppressing false positives\n\nTwo suppression mechanisms exist:\n\n### WORKSPACE.yaml (leeway sbom scan)\n\nAdd entries under `sbom.ignoreVulnerabilities` in `WORKSPACE.yaml`:\n\n```yaml\nsbom:\n  enabled: true\n  ignoreVulnerabilities:\n    - vulnerability: GHSA-xxxx-xxxx-xxxx\n      reason: |\n        Explanation of why this CVE is not exploitable in Gitpod's usage.\n```\n\n### Trivy ignore (image scanning)\n\nAdd entries to `scripts/trivy/trivyignore.yaml`:\n\n```yaml\nvulnerabilities:\n  - id: CVE-YYYY-NNNNN\n    paths:\n      - \"app/node_modules/package/package.json\"\n    statement: |\n      Explanation.\n```\n\n## Validation\n\nAfter making changes, validate locally before pushing:\n\n```bash\n# Quick: scan only the modules you changed\ngrype file:components/<module>/go.mod --only-fixed --output table\n\n# Thorough: scan all components\nfind components -name \"go.mod\" -not -path \"*/vendor/*\" \\\n  -exec sh -c 'echo \"=== {} ===\" && grype file:\"{}\" --only-fixed -q 2>/dev/null' \\; \\\n  2>&1 | grep -E \"^===|Critical|High\"\n\n# Build verification for key modules\nfor mod in common-go supervisor public-api-server ws-proxy ws-manager-mk2 \\\n           registry-facade blobserve content-service image-builder-mk3 \\\n           gitpod-cli local-app ide-metrics ide-service node-labeler \\\n           openvsx-proxy service-waiter ws-daemon image-builder-bob usage; do\n  echo \"=== Building components/$mod ===\" && \\\n  (cd \"components/$mod\" && go build ./...) || echo \"FAILED: $mod\"\ndone\n```\n\n## PR conventions\n\n- Title: \"Fix critical CVEs from daily vulnerability scan\" or similar.\n- Body: Include a table of updated packages with From/To versions and CVE IDs.\n- Tag with `team: staff-engineers` and `team: team-enterprise`.\n- Reference the Linear issue (e.g., \"Fixes: CLC-XXXX\").\n- List any CVEs that could NOT be addressed and why under \"Not addressed (requires follow-up)\".\n- Co-author: `Co-authored-by: Ona <no-reply@ona.com>`\n\n## Reference files\n\n- `references/ci-scanning.md` — CI pipeline details for vulnerability scanning.\n- `references/go-modules.md` — List of all Go modules and their scan-relevant groupings.\n</yakaai_skills>"}