Downgrade app to introduce vulnerabilities (testing CI pipeline)

[mikesir87]

Can be merged now

Various tests to determine if and how the Scout action should be used for gating

[github-actions]

Your image	dockerdevrel/catalog-service-node:pr-6
Current base image	node:22-bookworm-slim

Policy Status

(4/7 policies met, 2 missing data)

Status	Policy	Results
✅	Default non-root user
✅	No AGPL v3 licenses	0 packages
✅	No fixable critical or high vulnerabilities
✅	No high-profile vulnerabilities
❓	No outdated base images	No data Learn more ↗
❓	No unapproved base images	No data
⚠️	Missing supply chain attestation(s)	2 deviations

[github-actions]

Overview

Image reference	dockerdevrel/catalog-service-node:latest	dockerdevrel/catalog-service-node:pr-6
- digest	ecc7fdb194a7	580edef53fac
- tag	latest	pr-6
- environment	production
- provenance	7dc15b3	1284f1b
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	82 MB	82 MB (+21 B)
- packages	330	330
Base Image	node:22-bookworm-slim also known as: • 22-slim • 22.12-bookworm-slim • 22.12-slim • 22.12.0-bookworm-slim • 22.12.0-slim • jod-bookworm-slim • jod-slim • lts-bookworm-slim • lts-slim	node:22-bookworm-slim also known as: • 22-slim • 22.12-bookworm-slim • 22.12-slim • 22.12.0-bookworm-slim • 22.12.0-slim • jod-bookworm-slim • jod-slim • lts-bookworm-slim • lts-slim
- vulnerabilities

Labels (3 changes)

• ± 3 changed
• 5 unchanged

-org.opencontainers.image.created=2024-12-11T21:46:19.335Z
+org.opencontainers.image.created=2024-12-19T21:43:55.933Z
 org.opencontainers.image.description=
 org.opencontainers.image.licenses=CC0-1.0
-org.opencontainers.image.revision=7dc15b381f654bd4e5a122b102f017d0dfc307eb
+org.opencontainers.image.revision=1284f1bb192814fd5c7dc520925309dd1f12c26e
 org.opencontainers.image.source=https://github.com/dockersamples/catalog-service-node
 org.opencontainers.image.title=catalog-service-node
 org.opencontainers.image.url=https://github.com/dockersamples/catalog-service-node
-org.opencontainers.image.version=v0.1.0
+org.opencontainers.image.version=pr-6

Policies (0 improved, 1 worsened, 2 missing data)

Policy Name	dockerdevrel/catalog-service-node:latest	dockerdevrel/catalog-service-node:pr-6	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	✅	✅		No Change
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	❓ No data
No unapproved base images	✅	❓ No data
Supply chain attestations	✅	⚠️ 2	+2	Worsened