release: v1.4.33

[mfreeman451]

Summary

Cuts v1.4.33 on GitHub (Forgejo is no longer the release remote).

• Inventory risk: NVD + CISA/VulnCheck KEV findings, KEV floor 90 on the Findings overlay, periodic DeviceRiskAssessmentWorker writing ocsf_devices.risk_score through DeviceRiskReducer only (PRs #5008, feat(inventory): periodic risk engine with KEV scoring and IOC exposure #3591).
• EventWriter: expire stale JetStream pull inflight so otel-traces / otel-metrics / logs stop parking after a hung fetch (fix(event-writer): expire stale JetStream pull inflight #3764).
• Settings first-party Wasm plugin and native add-on import now reads GitHub Releases + Harbor OCI. ForgejoOciClient is gone; shared transport is FirstPartyReleaseClient. GitHubImporter is unchanged (source-tree plugin.yaml / plugin.wasm).
• scripts/cut-release.sh --remote so the annotated tag can target github instead of unreachable Forgejo origin.
• CI cache-proxy test runfiles include the GitHub integration workflow.

Merge / tag

Please merge with a merge commit, not squash. After CI is green and the merge is on staging:

git fetch github refs/heads/staging:refs/remotes/github/staging
git merge-base --is-ancestor 'v1.4.33^{commit}' refs/remotes/github/staging
git push github refs/tags/v1.4.33:refs/tags/v1.4.33

The annotated tag is local on this branch tip (b06b82a974). Do not publish it until that commit is an ancestor of staging.

Test plan

• bazel test -c opt --config=ci //elixir/web-ng:unit_tests_app_domain //elixir/web-ng:unit_tests_phoenix_live with plugin/addon filters (worktree)
• CI on this PR
• After merge + tag: GitHub Release artifacts / Harbor sha tags
• Settings → Plugins / Add-ons catalog sync against github.com/carverauto/serviceradar releases

[Copilot]

Pull request overview

Cuts the v1.4.33 release and completes the repo’s release/import migration from Forgejo to GitHub by updating release tooling, Helm defaults, and web-ng’s first-party plugin/native add-on import paths to resolve assets from GitHub Releases (plus Harbor OCI).

Changes:

• Bumps release metadata (VERSION, Helm Chart.yaml, demo ArgoCD source) and adds the v1.4.33 CHANGELOG entry.
• Extends scripts/cut-release.sh with --remote so tag occupancy checks / branch pushes can target github instead of origin.
• Updates web-ng first-party import config/docs/tests and transport code to use GitHub Releases URLs and trusted-host validation.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
VERSION	Bumps version to 1.4.33.
CHANGELOG	Adds v1.4.33 release notes.
scripts/cut-release.sh	Adds --remote and updates push/tag instructions to use the chosen remote.
helm/serviceradar/Chart.yaml	Bumps chart version/appVersion to 1.4.33.
helm/serviceradar/values.yaml	Updates first-party import repo defaults/comments to github.com.
helm/serviceradar/templates/web.yaml	Updates env defaults/comments for GitHub-based first-party import.
helm/serviceradar/.argocd-source-serviceradar-demo-prod.yaml	Updates demo-prod source parameter to v1.4.33.
BUILD.bazel	Adds GitHub workflow file to cache-proxy test runfiles.
elixir/web-ng/config/config.exs	Switches default first-party import repo URL to GitHub.
elixir/web-ng/.dialyzer_ignore.exs	Moves ignore entry to first_party_release_client.ex.
elixir/web-ng/lib/serviceradar_web_ng/plugins/first_party_release_client.ex	Renames/retargets shared transport to GitHub Releases + updates trust/URL validation.
elixir/web-ng/lib/serviceradar_web_ng/plugins/first_party_importer.ex	Swaps transport import to FirstPartyReleaseClient + updates metadata strings/docs.
elixir/web-ng/lib/serviceradar_web_ng/plugins/native_addon_importer.ex	Swaps transport alias to FirstPartyReleaseClient + updates docs.
elixir/web-ng/lib/serviceradar_web_ng/plugins/first_party_sync_worker.ex	Updates module docs to GitHub Releases wording.
elixir/web-ng/lib/serviceradar_web_ng/plugins/native_addon_sync_worker.ex	Updates module docs to GitHub Releases wording.
elixir/web-ng/lib/serviceradar_web_ng_web/live/admin/plugin_package_live/index.ex	Updates UI messaging to GitHub wording.
elixir/web-ng/lib/serviceradar_web_ng_web/live/admin/addon_package_live/index.ex	Updates default repo URL to GitHub.
elixir/web-ng/test/phoenix/live/admin/plugin_package_live_test.exs	Updates test stubs/URLs from Forgejo → GitHub.
elixir/web-ng/test/phoenix/live/admin/addon_package_live_test.exs	Updates release URL expectations to GitHub.
elixir/web-ng/test/app_domain/plugins/packages_test.exs	Updates first-party release URL expectations to GitHub.
elixir/web-ng/test/app_domain/plugins/native_addon_importer_test.exs	Updates URLs and redaction test strings for GitHub migration.
elixir/web-ng/test/app_domain/plugins/first_party_importer_test.exs	Updates stubs/error strings and URLs for GitHub migration.

Suppressed comments (2)

elixir/web-ng/lib/serviceradar_web_ng/plugins/first_party_release_client.ex:510

• auth_headers/0 builds the Authorization header using a hard-coded redaction string ("******") instead of the actual token. That will break authenticated GitHub API calls (and also produces an unused-variable warning for token). Return the real header value here; logging/telemetry redaction should happen at the logger layer, not in the outbound request.
  elixir/web-ng/lib/serviceradar_web_ng/plugins/first_party_release_client.ex:547
• validate_url/1 now short-circuits OutboundURLPolicy for allowlisted hosts, but it also implicitly allowlists any HTTPS port for those hosts (e.g. https://github.com:8443/...). OutboundURLPolicy previously enforced an allowlisted port set (443 by default). Consider keeping that safety property by requiring port in [nil, 443] for the allowlisted-host fast path.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.