From 61c8e80e3c75c51de1a63f6c508ae17bc7655a4e Mon Sep 17 00:00:00 2001
From: "Gavin Barron (from Dev Box)" <gavinbarron@microsoft.com>
Date: Tue, 21 Jul 2026 11:13:17 -0700
Subject: [PATCH] Remediate S360 ReplaceVulnerableRegistryReference for
 microsoftgraph/powershell image

The image was published only on v* release tags and built FROM mcr.microsoft.com/powershell (floating latest), so the stored digest went stale between releases and accrued Ubuntu USN / PowerShell CVEs (S360 KPI 527fb616-07aa-8198-6419-50d04ef1c2f3, service Graph DevX).

Changes: pin the base to a maintained *-ubuntu-22.04 tag via ARG PS_BASE_TAG (default lts-ubuntu-22.04); add .azure-pipelines/docker-image-refresh.yml, an image-only weekly rebuild (always:true) that republishes a patched digest without running the full release/sign/PSGallery stages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d3f8fec7-b00b-46be-ba39-7e1f3e7f7188
---
 .azure-pipelines/docker-image-refresh.yml | 98 +++++++++++++++++++++++
 Dockerfile                                |  9 ++-
 2 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 .azure-pipelines/docker-image-refresh.yml

diff --git a/.azure-pipelines/docker-image-refresh.yml b/.azure-pipelines/docker-image-refresh.yml
new file mode 100644
index 00000000000..ce5ff5b745b
--- /dev/null
+++ b/.azure-pipelines/docker-image-refresh.yml
@@ -0,0 +1,98 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+#
+# Scheduled rebuild of the microsoftgraph/powershell container image.
+#
+# Why this pipeline exists:
+#   The release pipeline (sdk-release.yml) only builds and pushes this image on `v*` tags, so
+#   between releases the published digest goes stale and keeps accruing Ubuntu USN / PowerShell
+#   CVEs. That is the root cause of the two S360 "Replace Vulnerable Registry Reference" items.
+#   This lightweight pipeline rebuilds the image on a cadence against a patched base and pushes a
+#   fresh digest to :latest, keeping the registry copy patched without re-running the full release.
+#
+# Setup (one-time): register this YAML as a new pipeline definition in the
+#   "Graph Developer Experiences" ADO project, targeting the default branch.
+name: $(Date:yyyyMMdd)$(Rev:.r)_docker-image-refresh
+
+parameters:
+- name: LinuxPool
+  type: string
+  default: Azure-Pipelines-1ESPT-ExDShared
+
+variables:
+  REGISTRY: 'msgraphprodregistry.azurecr.io'
+  IMAGE_NAME: 'public/microsoftgraph/powershell'
+
+# Rebuild weekly so the image regularly picks up patched OS layers. `always: true` forces a run
+# even when there are no new commits (the whole point is to refresh the base image).
+schedules:
+- cron: "0 6 * * 1"   # 06:00 UTC every Monday
+  displayName: Weekly image refresh
+  branches:
+    include:
+    - main
+  always: true
+
+# Do not build on every push/PR; the release pipeline already handles tag-driven publishes.
+trigger: none
+pr: none
+
+resources:
+  repositories:
+  - repository: 1ESPipelineTemplates
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
+  parameters:
+    pool:
+      name: ${{ parameters.LinuxPool }}
+      image: ubuntu-latest
+      os: linux
+    settings:
+      networkIsolationPolicy: Permissive
+    customBuildTags:
+    - ES365AIMigrationTooling
+    stages:
+    - stage: RefreshDockerImage
+      displayName: 'Refresh docker image'
+      jobs:
+      - job: RebuildAndPush
+        displayName: 'Rebuild and push patched image'
+        pool:
+          name: ${{ parameters.LinuxPool }}
+          image: ubuntu-latest
+          os: linux
+        steps:
+        - checkout: self
+
+        - task: AzureCLI@2
+          displayName: 'Log in to Azure Container Registry'
+          inputs:
+            azureSubscription: 'ACR Images Push Service Connection'
+            scriptType: 'bash'
+            scriptLocation: 'inlineScript'
+            inlineScript: |
+              az acr login --name $(REGISTRY)
+
+        - script: |
+            docker run --privileged --rm tonistiigi/binfmt --install all
+          displayName: 'Enable multi-platform builds'
+
+        - script: |
+            docker buildx create --use --name refreshbuilder
+          displayName: 'Set up Docker BuildX'
+
+        - bash: |
+            set -euo pipefail
+            formatted_date=$(date +"%Y%m%d%H%M%S")
+            echo "Rebuilding $(REGISTRY)/$(IMAGE_NAME) on a patched base"
+            docker buildx build \
+              --platform linux/amd64 \
+              --push \
+              -t "$(REGISTRY)/$(IMAGE_NAME):latest" \
+              -t "$(REGISTRY)/$(IMAGE_NAME):$formatted_date" \
+              "$(Build.SourcesDirectory)"
+          displayName: 'Build and push refreshed image'
diff --git a/Dockerfile b/Dockerfile
index dbaae9a9223..fa1968e7e7b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,11 @@
-FROM mcr.microsoft.com/powershell
+# Pin to a maintained Ubuntu 22.04 PowerShell base tag instead of the floating :latest.
+# The PowerShell team rebuilds these date-stamped rolling tags with patched OS layers, so a
+# scheduled rebuild (see .azure-pipelines/docker-image-refresh.yml) picks up Ubuntu/USN and
+# PowerShell CVE fixes and produces a fresh digest, clearing the S360
+# "Replace Vulnerable Registry Reference" findings. Override at build time with
+# --build-arg PS_BASE_TAG=<tag> (e.g. 7.4-ubuntu-22.04 or lts-ubuntu-22.04).
+ARG PS_BASE_TAG=lts-ubuntu-22.04
+FROM mcr.microsoft.com/powershell:${PS_BASE_TAG}
 
 ARG VERSION=latest