semantica

mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00

Files

T

KaifAhmad1 3f57bab9d3 fix(ci): suppress false-positive checkov K8s checks on Knative YAML; drop redundant seccomp annotation

checkov scans deploy/gcp/cloudrun-service.yaml as a Kubernetes resource
(it has apiVersion: serving.knative.dev/v1) and raises CKV_K8S_28 /
CKV_K8S_30. Adding those annotations to spec.template.metadata.annotations
caused checkov to crash (exit 1 with no SARIF output) — likely a bug in
checkov's AppArmor check when it tries to match the annotation container
name against containers in a Knative RevisionSpec. Fix:
  - Remove the AppArmor / seccomp annotations from the template metadata
  - Add checkov:skip comments at the file top so the false-positive checks
    are suppressed cleanly (Cloud Run enforces these at platform level)

Also drop the legacy seccomp.security.alpha.kubernetes.io/pod annotation
from deploy/helm/knowledge-explorer/values.yaml: run #186 confirmed that
the modern podSecurityContext.seccompProfile.type: RuntimeDefault field
already satisfies CKV_K8S_28 for the Helm chart without the annotation.
Adding the annotation alongside the modern field was causing the same
crash in checkov's Helm-rendered output.

2026-06-24 13:55:41 +05:30

azure

fix(ci): remove Knative pod-level securityContext and fix Bicep null ternary

2026-06-24 13:41:28 +05:30

fly

fix(deploy): harden security in deployment templates and explorer app

2026-06-24 12:51:09 +05:30

gcp

fix(ci): suppress false-positive checkov K8s checks on Knative YAML; drop redundant seccomp annotation

2026-06-24 13:55:41 +05:30

helm

fix(ci): suppress false-positive checkov K8s checks on Knative YAML; drop redundant seccomp annotation