Using Verifications to check image scanning results

[patpicos]

I am progressing in POC'ing Kargo to use for promoting our applications between dev/int/prd. Now I am investigating/prototyping the use of verifications.

My use cases:

1. (Scope of this discussion) Initiate / Review image scan results for new images in a Warehouse
2. (Scope of this discussion) Initiate replication of images (we run multiple ECRs and I plan on having an API to move images between them. dont ask me why we are doing this!).
3. (out-of-scope for discussion) - Validate the health of the application (pods healthy, prometheus queries) ....this is for a later discussion.

For the image scanning, my current project has 8 image sources in my warehouse

---
apiVersion: kargo.akuity.io/v1alpha1
kind: Warehouse
metadata:
    name: images
    namespace: kargo-crossplane-compositions-images
spec:
    subscriptions:
        - image:
              repoURL: xpkg.upbound.io/crossplane-contrib/function-kcl
              semverConstraint: ^0.11.4
        - image:
              repoURL: xpkg.upbound.io/upbound/function-auto-ready
              semverConstraint: ^0.4.2
        - image:
              repoURL: xpkg.upbound.io/crossplane-contrib/function-environment-configs
              semverConstraint: ^0
        - image:
              repoURL: xpkg.upbound.io/upbound/provider-family-aws
              semverConstraint: ^1.22.x # ^1.22.x is equivalent to >= 1.22.0, < 2.0.0
        - image:
              repoURL: xpkg.upbound.io/crossplane-contrib/provider-argocd
              semverConstraint: ^0.11.0
        - image:
              repoURL: xpkg.upbound.io/crossplane-contrib/provider-gitlab
              semverConstraint: ^0.10.0 # we are on 0.10.3
        - image:
              repoURL: xpkg.upbound.io/upbound/provider-kubernetes
              semverConstraint: ^0.17.1
        - image:
              repoURL: xpkg.upbound.io/crossplane-contrib/provider-http
              semverConstraint: ^1.0.8

I also created a sample AnalysisTemplate

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: bliss-image-scan
  namespace: kargo-crossplane-compositions-images
spec:
  args:
    - name: repo
    - name: tag
  metrics:
    - name: check-external-api
      successCondition: result == "PASS"
      provider:
        web:
          url: http://bliss-scan-result:8080/scan?account_id=155880749572&repository_name={{args.repo}}&tag={{args.tag}} #  https://api.example.com/validate?image={{args.image}}
          method: GET
          # Local API is not authenticated.
          # headers:
          #   - name: Authorization
          #     valueFrom:
          #       secretKeyRef:
          #         name: external-api-token
          #         key: token
          timeoutSeconds: 10
          jsonPath: "{$.result}"

Sample Payload of calling the above api

{
    "account_id": "155880749572",
    "repository": "crossplane/crossplane",
    "tag": "v1.20.0",
    "result": "PASS",
    "reason": "",
    "vulnerabilities": [
        {
            "cve_id": "nan",
            "description": "No vulnerabilities nor compliance issues",
            "epss": "",
            "percentile": "",
            "image_tags": "v1.20.0,latest",
            "approval_status": "approved",
            "approver_email_id": "Auto Approved",
            "approved_date": "06-09-2025 10:00:11"
        }
    ]
}

Then I am looking to call the verification from the Stage. I noticed that the args are not under the individual referenced analysisTemplates.
Questions):

• I am trying to understand how the Analysis can be kicked off and loop through all the images from the warehouse. if all pass the validation, then the validation passes.
• What is the best approach to loop thru the images from the warehouse?
• Is this a valid use of AnalysisTemplates?

apiVersion: kargo.akuity.io/v1alpha1
kind: Stage
metadata:
  name: crossplane-chart
  labels:
    environment: development
  annotations:
    kargo.akuity.io/color: green
  namespace: kargo-crossplane-compositions-images
spec:
  requestedFreight:
    - origin:
        kind: Warehouse
        name: images
      sources:
        direct: true
  promotionTemplate:
    spec:
      steps:
        - task:
            name: promote-images-to-chart
  # I would like the below to be dynamic by iterating thru .images from the Freight
  # Just to validate the integration, i hard coded the repo name and pulled the tag from the Freight
  verification:
    analysisTemplates:
      - name: bliss-image-scan
    args:
      - name: repo
        value: crossplane-contrib/function-environment-configs
      - name: tag
        value: ${{ imageFrom("xpkg.upbound.io/crossplane-contrib/function-environment-configs").Tag }}

Referenced issues/documentation:

• Pass dynamic information to AnalysisRun #2482
• docs: clarify requirement for declaring AnalysisTemplate args #4471
• feat: support Expression Language in Stage verification args #3408