feat(validation): add workflow image vetting by CameronMcClymont · Pull Request #739 · reanahub/reana-server

CameronMcClymont · 2025-07-16T13:05:40Z

Extend validate_workflow to check that all images used in workflows are authorized. Such authorized images are specified via the vetted_container_images Helm value. Also add details of container vetting to the info API endpoint.

Closes #728

CameronMcClymont · 2025-07-16T13:40:29Z

+    steps = reana_yaml["workflow"].get("specification", {}).get("steps", [])
+
+    for step in steps:
+        step_image = step.get("environment", None)


I was a bit unsure about this - is this the correct place to get the user workflow images from?

codecov · 2025-07-16T14:56:45Z

Codecov Report

❌ Patch coverage is 89.47368% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.19%. Comparing base (db21167) to head (32d7491).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
reana_server/rest/workflows.py	50.00%	1 Missing ⚠️
reana_server/validation.py	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #739      +/-   ##
==========================================
+ Coverage   60.06%   60.19%   +0.12%     
==========================================
  Files          33       33              
  Lines        4074     4092      +18     
==========================================
+ Hits         2447     2463      +16     
- Misses       1627     1629       +2

Files with missing lines	Coverage Δ
reana_server/config.py	`87.26% <100.00%> (+0.09%)`	⬆️
reana_server/rest/info.py	`96.34% <100.00%> (+0.23%)`	⬆️
reana_server/rest/workflows.py	`49.36% <50.00%> (+<0.01%)`	⬆️
reana_server/validation.py	`68.75% <90.00%> (+2.08%)`	⬆️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Extend `validate_workflow` to check that all images used in workflows are authorized. Such authorized images are specified via the `vetted_container_images` Helm value. Also add details of container vetting to the `info` API endpoint.

michaelbuchar · 2026-06-01T14:48:58Z

            )


+def validate_images(reana_yaml: Dict) -> None:


I think this only scans workflow.specification.steps. Yadage uses nested stages and CWL uses requirements[].dockerPull. The client already contains extraction logic for Yadage and CWL. Maybe let's move the shared extraction into reana-commons or implement equivalent server extractors?

Yes good idea, moved image extraction logic to reana-commons

michaelbuchar · 2026-06-01T14:50:35Z

+    for step in steps:
+        image = step.get("environment", None)
+        if image and image not in allowed_images:
+            raise REANAValidationError(f"Image not allowed: {image}")


The server ignores falsey environments here. Snakemake jobs without an explicit image use REANA_DEFAULT_SNAKEMAKE_ENV_IMAGE client fallback. Maybe let's also vet the resolved default image?

We don't need to vet the default image because both the list of vetted images and the default snakemake env image are set by cluster admins (i.e. REANA_DEFAULT_SNAKEMAKE_ENV_IMAGE is trustworthy so doesn't need to be vetted).

michaelbuchar · 2026-06-01T14:53:02Z

+REANA_VETTED_CONTAINER_IMAGES = json.loads(
+    os.getenv("REANA_VETTED_CONTAINER_IMAGES", "{}")
+)
+"""Container images that users are allowed to use in their workflows."""


The environment variable defaults to {} in config.py, but validation and info index both keys. This probably breaks standalone deployments and version skewed rollouts. Maybe let's default to {"enabled": false, "allowlist": []}?

Oh ye nice catch, updated the default now.

michaelbuchar · 2026-06-01T14:53:53Z

                },
+                "vetted_container_images_enabled": {
+                    "title": "Whether container image vetting is enabled",
+                    "value": "False"


The schema declares a boolean, but the example uses "False" as a string in reana-server and the generated reana-commons snapshot. Use JSON false and regenerate the specification.

Thanks, fixed!

michaelbuchar · 2026-06-01T14:55:48Z

Maybe we can add more engine specific tests as well?

Extend `validate_workflow` to check that all images used in workflows are authorized. Such authorized images are specified via the `vetted_container_images` Helm value. Also add details of container vetting to the `info` API endpoint.

CameronMcClymont · 2026-06-03T13:19:29Z

Some tests are failing due to dependency on new reana-commons version: reanahub/reana-commons#497

All tests pass locally:

Extend `validate_workflow` to check that all images used in workflows are authorized. Such authorized images are specified via the `vetted_container_images` Helm value. Also add details of container vetting to the `info` API endpoint.

tiborsimko · 2026-06-04T16:06:20Z

                    ]
                ],
            ),
+            vetted_container_images_enabled=dict(


🤖 reana-client-go info drops vetted image settings (MEDIUM)

The Python client seems fine here, but reana-client-go info will not show these new settings yet. Its generated InfoOKBody model does not include vetted_container_images_enabled or vetted_container_images_allowlist, and the human-readable output in cmd/info.go is hardcoded field by field. As a result, both plain output and likely --json output discard these fields even though the server OpenAPI now exposes them.

Could we please update reana-client-go as part of this change as well? The fix should be to regenerate the Go client from the updated reana-server/docs/openapi.json, add the two fields to cmd/info.go, and update the info command fixtures/tests.

Fixed in a new reana-client-go PR: reanahub/reana-client-go#182

Extend `validate_workflow` to check that all images used in workflows are authorized. Such authorized images are specified via the `vetted_container_images` Helm value. Also add details of container vetting to the `info` API endpoint.

Extend `validate_workflow` to check that all images used in workflows are authorized. Such authorized images are specified via the `vetted_container_images` Helm value. Also add details of container vetting to the `info` API endpoint. Co-authored-by: Tibor Šimko <tibor.simko@cern.ch>

tiborsimko

🤖 GitLab webhook path publishes workflows without image vetting (HIGH)

reana_server/rest/workflows.py:540-613 short-circuits to publish_workflow_submission when git_data is present, bypassing the start endpoint where validate_workflow() → validate_images() normally runs. With vetting enabled, an unvetted image referenced in a GitLab-tracked reana.yaml will still be queued and executed.

Adding validate_images() only at create-time isn't enough on its own: GitLab reana.yaml files commonly use workflow.file:, so the initial yaml.safe_load() carries no workflow.specification and the early check no-ops. The specification is materialised later by _load_and_save_yadage_spec / load_reana_spec at lines 600-610. The vetting check therefore has to run after that load.

Suggested fix — add the import and two validate_images() calls:

from reana_server.validation import (
    validate_images,
    validate_inputs,
    validate_workflow,
    validate_workspace_path,
    validate_dask_limits,
)

        validate_inputs(reana_spec_file)

        validate_images(reana_spec_file)   # catches inline-spec workflows

        validate_dask_limits(reana_spec_file)

            elif workflow.type_ in ["cwl", "snakemake"]:
                reana_yaml_path = os.path.join(workflow.workspace_path, "reana.yaml")
                workflow.reana_specification = load_reana_spec(
                    reana_yaml_path, workflow.workspace_path
                )
                Session.commit()

            validate_images(workflow.reana_specification)   # closes the GitLab bypass

            parameters = request.json
            publish_workflow_submission(workflow, user.id_, parameters)

Worth adding a tests/test_views.py case that posts a git_data create with a disallowed image and asserts the webhook returns 400 before publish_workflow_submission is reached.

tiborsimko · 2026-06-07T14:21:45Z

🤖 GitLab webhook path publishes workflows without image vetting (HIGH)

[...]

Suggested fix — add the import and two validate_images() calls:

I've added a quick fix to the PR and squashed.

CameronMcClymont self-assigned this Jul 16, 2025

CameronMcClymont added a commit to CameronMcClymont/reana-server that referenced this pull request Jul 16, 2025

feat(validation): add workflow image vetting (reanahub#739)

1086dd2

CameronMcClymont force-pushed the vetted-containers branch from 4e42ba2 to 1086dd2 Compare July 16, 2025 13:09

CameronMcClymont commented Jul 16, 2025

View reviewed changes

CameronMcClymont added a commit to CameronMcClymont/reana-server that referenced this pull request Jul 16, 2025

feat(validation): add workflow image vetting (reanahub#739)

476b200

CameronMcClymont force-pushed the vetted-containers branch from 1086dd2 to 476b200 Compare July 16, 2025 14:23

CameronMcClymont added a commit to CameronMcClymont/reana-server that referenced this pull request Jul 16, 2025

feat(validation): add workflow image vetting (reanahub#739)

463cf5a

CameronMcClymont force-pushed the vetted-containers branch from 476b200 to 463cf5a Compare July 16, 2025 14:52

CameronMcClymont added a commit to CameronMcClymont/reana-server that referenced this pull request Jul 16, 2025

feat(validation): add workflow image vetting (reanahub#739)

d415746

CameronMcClymont force-pushed the vetted-containers branch from 463cf5a to d415746 Compare July 16, 2025 14:53

CameronMcClymont force-pushed the vetted-containers branch from d415746 to 52fce39 Compare July 17, 2025 12:47

CameronMcClymont requested a review from tiborsimko July 17, 2025 12:52

CameronMcClymont force-pushed the vetted-containers branch from 52fce39 to 7b63032 Compare May 20, 2026 13:02

CameronMcClymont force-pushed the vetted-containers branch from 7b63032 to c5e1c16 Compare May 20, 2026 13:34

michaelbuchar reviewed Jun 1, 2026

View reviewed changes

CameronMcClymont force-pushed the vetted-containers branch from c5e1c16 to 7afd768 Compare June 3, 2026 13:13

CameronMcClymont force-pushed the vetted-containers branch from 7afd768 to 4e8a17a Compare June 3, 2026 13:13

CameronMcClymont requested a review from michaelbuchar June 3, 2026 13:18

CameronMcClymont force-pushed the vetted-containers branch from 4e8a17a to 0f6e1e5 Compare June 4, 2026 13:53

CameronMcClymont force-pushed the vetted-containers branch from 0f6e1e5 to d302ec0 Compare June 4, 2026 15:02

tiborsimko reviewed Jun 4, 2026

View reviewed changes

CameronMcClymont added a commit to CameronMcClymont/reana-server that referenced this pull request Jun 5, 2026

chore(master): update reana-commons to 0.95.0a19 (reanahub#739)

6053d6d

CameronMcClymont force-pushed the vetted-containers branch from 9953490 to 6053d6d Compare June 5, 2026 09:32

tiborsimko mentioned this pull request Jun 5, 2026

feat(info): display workflow image vetting settings reanahub/reana-client-go#182

Merged

CameronMcClymont added a commit to CameronMcClymont/reana-server that referenced this pull request Jun 5, 2026

chore(master): update reana-commons to 0.95.0a19 (reanahub#739)

1ad65b8

CameronMcClymont force-pushed the vetted-containers branch from 6053d6d to 1ad65b8 Compare June 5, 2026 11:40

tiborsimko reviewed Jun 7, 2026

View reviewed changes

tiborsimko force-pushed the vetted-containers branch from 1ad65b8 to 32d7491 Compare June 7, 2026 14:22

tiborsimko merged commit 32d7491 into reanahub:master Jun 7, 2026
19 checks passed

github-actions Bot mentioned this pull request Jun 4, 2026

chore(master): release 0.9.5 #679

Open

Uh oh!

Conversation

CameronMcClymont commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CameronMcClymont Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michaelbuchar commented Jun 1, 2026

Uh oh!

CameronMcClymont commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tiborsimko left a comment

Choose a reason for hiding this comment

Uh oh!

tiborsimko commented Jun 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CameronMcClymont commented Jul 16, 2025 •

edited

Loading

codecov Bot commented Jul 16, 2025 •

edited

Loading

CameronMcClymont Jun 3, 2026 •

edited

Loading

CameronMcClymont commented Jun 3, 2026 •

edited

Loading