Change Anchore to not force add images if the digest already exists in the working set
Recently we've seen massive backlogs of images where the scans eventually happen in Anchore, but after the stage in the pipeline has already timed out. Once an image's digest is in Anchore, you can get new vulnerability results without a rescan as the vuln data from the feeds in reapplied to the digest when queried. We can make three separate cases in the Anchore stage.
-
The digest already exists, so grab the new vuln results and return them
-
The digest was recently added and the scans are still running. Continue waiting. (This will prevent rerunning pipelines and getting added to the back of the backlog)
-
The digest doesn't exist, so add it and wait
-
The above has been implemented
Edited by Michael Simmons