docs: specify automated vulnerability visibility (R-VULN-*, ADR-0027) #4

Open

gitea-admin wants to merge 3 commits from feature/vulnerability-visibility into main

pull from: feature/vulnerability-visibility

Author	SHA1	Message	Date
jakman85andClaude Opus 5.5	46996d1f8a	Merge main into feature/vulnerability-visibility Keeps both ADR index rows (0026 from #3 and 0027 from this branch). Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 12:52:25 -06:00
jakman85andClaude Opus 5.5	28a1c0a2eb	docs(17): resolve two implementation escalations on registry state and SSO egress credential-required now comes from a declared registry list, because LAN egress is excluded and the scanner could never receive a refusal from the private registry. The egress list now names the Gateway and identity provider, which the SSO sidecar needs. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 12:52:03 -06:00
jakman85andClaude Opus 5.5	0fb44bb0a8	docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027) Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the cluster, a versioned report, an SSO page listing each CVE against its images, containers and workloads, grouped email alerts, and a Renovate-shaped CI triage bot. Renovate stays the only author of version changes, and "not scanned" is always visible rather than reading as clean. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-11-09 09:21:52 -06:00

Author

SHA1

Message

Date

jakman85andClaude Opus 5.5

46996d1f8a

Merge main into feature/vulnerability-visibility

Keeps both ADR index rows (0026 from #3 and 0027 from this branch).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-09 12:52:25 -06:00

jakman85andClaude Opus 5.5

28a1c0a2eb

docs(17): resolve two implementation escalations on registry state and SSO egress

credential-required now comes from a declared registry list, because LAN egress
is excluded and the scanner could never receive a refusal from the private
registry. The egress list now names the Gateway and identity provider, which
the SSO sidecar needs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-09 12:52:03 -06:00

jakman85andClaude Opus 5.5

0fb44bb0a8

docs: specify automated vulnerability visibility for production (R-VULN-*, ADR-0027)

Adds R-VULN-01..09, docs/17 and ADR-0027: a scheduled digest scanner in the
cluster, a versioned report, an SSO page listing each CVE against its images,
containers and workloads, grouped email alerts, and a Renovate-shaped CI triage
bot. Renovate stays the only author of version changes, and "not scanned" is
always visible rather than reading as clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-09 09:21:52 -06:00