Repository navigation
Full review - #26
Merged
Merged
Full review#26
Conversation
A scan judges what a clean build produces today. A cached apt-get upgrade layer or a stale base image keeps a package version that is already fixed, on a runner whose Docker daemon outlives the job. Trivy gets --no-progress since a CI log is not a terminal. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BurkSVvSTdqzabro1Fs1nk
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ns only Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…y workflow start it Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lon as a mapping Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…hand it in as BASE_IMAGE An image built on another one of the same repository was scanned on the published base, so the scan read a base this commit does not build. When the caller is this repository, the scan uses the actions of its checkout, as the Terraform quality workflow does. A CI job checks the derived image is built on a base marked by the run, and .istarci.yml gives the jobs the Docker socket it builds with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeKfwoPiMUSurT6NZGAPhP
…ing a network of their own Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeKfwoPiMUSurT6NZGAPhP
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BeKfwoPiMUSurT6NZGAPhP
…ariables, and build .NET code in its working directory Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QfFh6KhG7gWxW2NtewgcK9
…r is this repository Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QfFh6KhG7gWxW2NtewgcK9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QfFh6KhG7gWxW2NtewgcK9
… the tests found The static checks run actionlint, shellcheck on the scripts of the composite actions, and the conventions of this repository. The CI runs the actions it did not run yet, checks the version inputs, and checks that a missing release, a wrong checksum or a finding fails. Inputs and secrets reach the scripts through env variables, curl fails on an HTTP error, and a failed checksum prints its error. Every reusable workflow tests the workflow parts of its own commit when the caller is this repository. The official actions and the linters are pinned to a commit or a version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…tarCI runs each commit by itself A reader closing the pipe early failed the version check with SIGPIPE under pipefail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…ted out actions to a commit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…ET tools, upload the .NET reports, and give every job a timeout The publication workflow runs no tonistiigi/binfmt image, which a setup action replaces with the qemu-user-static package the runner's distribution signs. ReportGenerator and the Sonar scanner are installed at a version, which keys the cache of the scanner. The .NET quality workflow uploads the report folder of its working directory, where the results, the coverage and the reports are. The Sonar path runs against the SonarQube IstarCI provides, and is skipped where no Sonar host is set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…d build the images with an action of their own The publication workflow builds each platform by digest, emulated with QEMU by default or on an arm64 runner given by arm64-runner, and tags, signs and describes the image in one job. The build runs on a builder of its own, removed afterwards, which a Docker daemon shared with other jobs would otherwise keep. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…s made with Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…'s variable again Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…n the whole repository Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6LLRv79eCs5Zj1jSPK3MP
…ask and change check actions, and let the Terraform deployment destroy Each one replaces steps several repositories copied, and is tested in the CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…run reads its outputs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…al run or a manual one Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ing part of the test arguments A variable the caller did not set is empty on GitHub, but a placeholder in a local run, which reached the test applications as an argument. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CQAQGtomMGWhkmqVEuUJLR
…on workflow gives as they are Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTVYojWrgtV6aKFgf2yjU2
…d secret variables, and run the steps before the clone from the root of the workspace Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTVYojWrgtV6aKFgf2yjU2
… own Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VTVYojWrgtV6aKFgf2yjU2
…for the registry, as a local run does, rather than failing on the registry refusing to answer Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…alysis of its own and MongoDB as a replica set The steps follow the npm scripts a repository already has (lint, format:check, typecheck, build and the test script), each skipped when missing, rather than one step running every command given. Optional custom tests run once the code is built, Playwright browsers come with a project depending on Playwright, and the workflow parts are set aside while the scripts of the repository run. The Sonar scanner CLI analyzes JavaScript and TypeScript with their lcov coverage, which the scanner for .NET does not. The MongoDB action takes a port and a replica set, and prints its log when the server does not start. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… the quality workflows Both scan the working directory, where the workflow parts are checked out beside the code, so the SBOM listed the dependencies of their fixtures. FOSSA only skipped them since it skips folders named test, which a manifest elsewhere in the parts would not be. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lt, as the Node.js quality workflow does A package whose build is its build script no longer needs a build command, and a repository whose root holds no package.json skips the build rather than failing on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…o fail on, an ignore file with expiry, and a registry login for a private base The thresholds were declared and never read, the scan failing on any finding whatever a caller passed, and a count of tolerated vulnerabilities would let through whichever came next. An ignore file names each vulnerability left out, with the reason and the day it counts again, as IstarCI does. NeuVector, commented out since 2026-02-22, and the switch turning Trivy off go, which left a job that only built. A login before the builds lets an image build on a base its owner keeps private, and is skipped where the run holds no token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ublic Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ilder running the BuildKit image Every BuildKit image, the latest release included, carries Go vulnerabilities with a fix, and runs with privileges in each job building an image. The builder of the daemon pushes no image by digest alone and builds one platform at a time, so each platform of several is pushed under a tag of its own, then put together under the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…at no script holds an expression GitHub pastes an expression into the script text before the shell reads it; eval reads the same text from a variable, quotes included, and the check of the scripts no longer keeps a list of inputs it lets through. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… negated command never did under errexit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ts overriding it only when given, and upload the test results of every workspace The inputs replaced the exclusions, the project key and the coverage paths a file sets, since the command line wins over it. The workflow parts are left out of git through .git/info/exclude, which Sonar follows without the exclusions of the project being replaced, where sonar.global.exclusions only works on the server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…h govulncheck The lint checks formatting with gofmt, go.mod and go.sum being tidy, and go vet, with no third party linter. govulncheck is installed with go install, which checks it against the Go checksum database, and fails on a known vulnerability of the code the module calls. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…d is given, on Node.js 24 by default npm ci, npm install for a site without a lock file, then the build script, as the Node.js quality workflow does, so a site whose build is its build script passes no command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…l and jq rather than a third party action It follows a sitemap index, decodes the addresses as XML writes them, sends at most 10,000 a request and fails on a submission IndexNow refuses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
… for, the latest release by default The version the action defaults to is written in the action alone, so moving to the next release is one change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…ind with kubectl, each checked against its SHA256 Each downloads the official release and checks it against the checksum file the release publishes, or a hash pinned here for kube-linter, whose release has none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…st its SHA256, for jobs running the scanners themselves Opengrep replaces its install.sh, run from the main branch of the project, with its release binary and a hash pinned here, the release publishing signatures but no checksum file. CodeQL comes from the bundle of the codeql-action releases, the CLI with its query packs, checked against the checksum file beside it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SESuYdZsJfq852odntm3Yi
…ir latest releases, with the new SHA256 checksums of mongosh, Opengrep and the Sonar scanner Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… fixes the official Debian based one lacks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tic is only a virtual package, as on Ubuntu 26.04 behind ubuntu-latest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…gainst SonarCloud, and name the .NET and properties file fixture projects after the repository
…I, which then names no variable left unset Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.