6 Commits

Include renames

Author	SHA1	Message	Date
jakman85	1ace03569c	Added required keycloak config	2026-11-09 16:29:29 -06:00
jakman85andClaude Opus 5.5	d8b25a67fe	fix(vuln): survive OOM kills, isolate bad upstream strings, label findings per line ... Review findings on the integrated scanner: - An OOM kill no longer wedges the loop: inFlight is persisted before each scan, and on restart that image is marked failed and sits out full runs for 20h. - One bad upstream string can no longer freeze the report: safe_url requires an exact lowercase scheme, acceptance reasons are bounded, /triage urls use the same rule, and report.build repairs or drops any entry the schema would refuse. lastCompleteRunAt advances only after a report is actually published. - The private registry reports credential-required, not failed: VULN_PRIVATE_REGISTRIES names it, and Trivy is not invoked. - loadError clears after a full run against a good inventory. - Every image under platform/vuln-scanner stays out of Renovate auto-merge. - The page labels status and target state per line, and mixed acceptance reads as mixed. The Keycloak client is still an operator action: its key must go in an existing encrypted file that an agent must not modify. platform/vuln-scanner/README.md has the exact steps. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 12:28:29 -06:00
jakman85	b1a6fe6503	Merge branch 'wip/vuln-platform' into feat/vuln-visibility	2026-11-09 10:29:05 -06:00
jakman85andClaude Opus 5.5	d4bea8a78c	feat(vuln): encrypted oauth2-proxy credential for the CVE page ... Generated through pipes and encrypted to the repo's public age recipient; values never echoed. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 09:43:12 -06:00
jakman85andClaude Opus 5.5	b85d1e3ed7	feat(vuln): vuln-scanner platform manifests, Flux tier, alerts, L0/L2/L3 tests ... Hand-authored platform/vuln-scanner (non-gating Flux tier, digest-pinned Trivy 0.76.1 and python 3.14.9-alpine, read-only RBAC, per-pod oauth2-proxy, internal-only cve.<domain>), five alerts with promtool tests, R-VULN-01..09 registry entries, and vuln-* L0 checks with mutation self-tests. src/ and the bot workflow are integrated separately. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 09:42:52 -06:00
jakman85andClaude Opus 5.5	50ec2297ee	feat(vuln): scanner service and fixture-driven L1 tests ... Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner, persisted state, schema-validated report.json, strict acceptances parser, server-rendered page, aggregate metrics, internal API, and a scan loop that stays live while scanning. L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the actual modules against recorded fixtures with a fake Trivy runner. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 09:41:23 -06:00