jakman85andClaude Opus 5.5
c3c72c47bb
Scheduled Gitea Actions bot in the Renovate shape: maintains a counts-only CVE Dashboard issue, derives remediation states from Renovate's dashboard and PRs, ticks approve rows for exact-matched images with an unaccepted CRITICAL with a fix, and posts the heartbeat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
32 lines
1.5 KiB
YAML
32 lines
1.5 KiB
YAML
# =============================================================================
|
|
# L1 RENDERING — CVE Dashboard issue carries aggregates only (R-VULN-05, R-VULN-07)
|
|
# Spec: docs/17 "The triage bot". GIVEN a report fixture with hostile and distinctive strings,
|
|
# WHEN the bot renders the dashboard issue, THEN no CVE id, package, image, workload, namespace or
|
|
# other report string appears, the counts are exact, and a deliberately leaking body is caught.
|
|
#
|
|
# render-check.sh is a pure offline check; this Chainsaw Test wraps the SAME script.
|
|
# =============================================================================
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vuln-triage-bot-dashboard-aggregates
|
|
labels:
|
|
conformance.home.k3s/R-VULN-05: "true"
|
|
conformance.home.k3s/R-VULN-07: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-VULN-05,R-VULN-07"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
# The script under test lives in .gitea/workflows/, which requirement-scoped selection does
|
|
# not attribute to R-VULN-*, so a change to it must still select this test.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/intent: >-
|
|
A dashboard issue rendered from a fixture contains counts and timestamps only, never a CVE id,
|
|
package, image or workload name.
|
|
spec:
|
|
steps:
|
|
- name: render-and-assert-aggregates-only
|
|
try:
|
|
- script:
|
|
content: bash ./render-check.sh
|