IssueTracker

Problem you have encountered:

We're encountering an issue with vulnerability scanning and VEX document uploads. While VEX documents are successfully uploaded via the artifact registry (AR) URL, these updates aren't reflected in the container image vulnerability scan results displayed in the user interface. Essentially, the system acknowledges the VEX upload, but the UI isn't properly reflecting the updated CVE statuses.

What you expected to happen:

The UI should reflect the VEX status correctly.

Steps to reproduce:

Requirement : Artifact registry with Scanning enabled

1. Upload images to scan for vulnerability.
2. If detected, create a VEX statement [1]
3. Upload the VEX statement [2]
4. View Status [3]

[1] https://cloud.google.com/artifact-analysis/docs/create-vex

[2] https://cloud.google.com/artifact-analysis/docs/upload-vex

[3] https://cloud.google.com/artifact-analysis/docs/view-vex

Important Note :

VEX feature is still under preview.