7 Commits

Include renames

Author	SHA1	Message	Date
jakman85	a4b441f3ad	Merge pull request 'chore(deps): Update docker.io/library/python Docker tag to v3.15.2' (#171) from renovate/docker.io-library-python-3.x into main ... Reviewed-on: #171	2026-11-14 21:58:51 +00:00
jakman85	8b51b02446	Merge pull request 'chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2' (#169) from renovate/ghcr.io-aquasecurity-trivy-0.x into main ... Reviewed-on: #169	2026-11-14 21:58:18 +00:00
jakman85andClaude Opus 5.5	3ae7fb74f8	fix(storage): bound the caches filling each node's /var ... The act-runner's Docker cache was an unbounded emptyDir on the 11.6 GiB /var partition and evicted k3s-prod-2 on 2026-11-12. It moves to a generic ephemeral volume on longhorn-scratch (off /var, pod-lifetime, single replica), with a threshold-triggered docker prune and Velero opt-out. vuln-scanner's cache sizeLimit and ephemeral-storage limit are cut to fit the partition, and it prefers not to share a node with buildkitd. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-14 14:15:00 -06:00
renovate-bot	7e612212a0	chore(deps): Update docker.io/library/python Docker tag to v3.15.2	2026-11-13 08:17:48 +00:00
renovate-bot	120913b04e	chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2	2026-11-13 08:16:36 +00:00
jakman85andClaude Opus 5.5	d8b25a67fe	fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line ... Review findings on the integrated scanner: - An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart that image is marked failed and sits out full runs for 20h. - One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a report is actually published. - The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names it, and Trivy is not invoked. - loadError clears after a full run against a good inventory. - Every image under platform/vuln-scanner stays out of Renovate auto-merge. - The page labels status and target state per line, and mixed acceptance reads as mixed. The Keycloak client is still an operator action: its key must go in an existing encrypted file that an agent must not modify. platform/vuln-scanner/README.md has the exact steps. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 12:28:29 -06:00
jakman85andClaude Opus 5.5	b85d1e3ed7	feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests ... Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 09:42:52 -06:00