Advanced
The token in every image
The billing service installs @shop/invoice-pdf from the company's private npm registry, so its build needs the CI's NPM_TOKEN. It is passed as a build argument, and a scan just found that token in the history of every billing image ever pushed. The token has been rotated; now make sure the next images do not carry the new one, while the build keeps installing the private package.
The CI runner exports NPM_TOKEN in its environment. The test runs docker compose build then docker compose up -d with Docker's build checks enabled, inspects every image it built, and calls http://<server>:8080/health for an hour.
What your server must hold
- No secret inside an image
- build.secretWarnings = 0
- Availability ≥ 99 %