Repository navigation
SimpleRisk 20261020-001 Release - #177
Merged
Merged
Conversation
Merge master back into testing after 20260917-001 GA
…ion, swagger-ui-dist template) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ches ubuntu:22.04 ships libc-bin 2.35-0ubuntu3.14; 3.15 (fixing 5 CVEs) is in jammy-updates. The minimal image already upgrades; the full-stack did not. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Each scan job uploads its grype.json (1-day retention); a final job builds one de-duplicated digest (package, then severity) and posts it to the SLACK_WEBHOOK_URL webhook, skipping cleanly when the secret is absent (fork PRs). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Fix Grype false positives, patch Jammy, sort results, post digest to Slack
…cl. all-clear) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…of :testing Factor the Grype scan and the report (summary + Slack digest) into composite actions shared by PR validation, publish-testing, and a new weekly workflow. publish-testing scans the pushed images before the SSM promote and blocks it on a critical finding. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…mary Scan published testing images, weekly :testing scan, per-image scan summary
…n with no findings Adds an always_post input to the grype-report action. When true, the Slack message carries one status line per scanned image (clean, findings by severity, or scan did not complete), so a quiet run still proves its scans ran. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ummary Post the per-image Grype scan table to Slack on PR and weekly runs
Asset discovery relies on ping, which neither the Ubuntu nor the php:*-apache base image ships. Add iputils-ping to the apt install lists in both generators and regenerate the Dockerfiles. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
feat: add iputils-ping to both images for asset discovery
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GA promotion of the
20261020-001release candidate.Opened automatically by code-development's
promote_docker_releaseworkflowwhen
20261020-001landed on code-developmentmaster.Merging this publishes the release: the push to
masterfirespromote-latest.yml, which retags Docker Hub:latestto thealready-built RC digest, mirrors it to GHCR cosign-signed, and moves the
tier=latestSSM tag. No image is rebuilt.The required image-build checks on this PR are the gate.