fix(cd): align Trivy gate + clear every remaining HIGH/CRITICAL - #167
Merged
Conversation
Third v0.1.0 firing failed on three fronts; this clears all of them: - cd.yml: limit-severities-for-sarif: true — with sarif format the action otherwise scans ALL severities and exit-code fires on ANY finding (lims failed on a MEDIUM despite a HIGH,CRITICAL gate). - analysis image: remove transformers (2 unfixable-in-range HIGHs); only the offline RLHF scripts used it and nothing imports them in serving paths. Stays in the root dev requirements, annotated. - python-dotenv>=1.1.1 across all four requirement sets. - web image: apk upgrade + remove npm/corepack from the runner (bundled tar/sigstore/glob CVEs), Next 15.5.21 + React 19 upgrade (peer bumps: @react-three/fiber ^9, drei ^10, lucide-react), postcss ^8.5.18 + override, sharp override ^0.35.3 (GHSA-f88m-g3jw-g9cj via next's image optimizer). - React 19 typing: dynamic icon props need React.ComponentType<{ className?: string }> (4 components). Proof: all four images rescanned locally with the gate's exact flags — analysis ZERO, lims ZERO, process-control ZERO, web ZERO. Suites: analysis 304 passed, lims 68, shared 88. E2E on Next 15: smoke 4/4, page sweep 26/26 (87 pages compile). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The third
v0.1.0CD firing failed all four Trivy scans. Root causes and fixes:format: sarif, trivy-action scans ALL severities andexit-code: 1fires on ANY finding — lims failed on a MEDIUM despite theHIGH,CRITICALsetting. Fixed withlimit-severities-for-sarif: true.transformerscarried 2 HIGHs with no in-range fix. Only the offline RLHF scripts (app/ml/rlhf) import it and nothing in the serving paths does — removed from the image, kept in the dev environment (annotated).apk upgrade+ removing npm/corepack from the runner, upgrading to Next 15.5.21 + React 19 (peer bumps: fiber ^9, drei ^10, lucide-react), postcss ^8.5.18, and asharp ^0.35.3override (GHSA-f88m-g3jw-g9cj).python-dotenv>=1.1.1across all four requirement sets (was the lims MEDIUM).React.ComponentType<{ className?: string }>(4 files).Proof
tsc --noEmitclean, 87 pages compile, smoke 4/4, 26-page sweep green (re-ran smoke after the sharp override: still 4/4)After merge: re-point
v0.1.0for the fourth CD firing.🤖 Generated with Claude Code