mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-01 04:00:28 +00:00
Mohd Kaif
fa87a1a9be
* ci: add npm Dependabot ecosystem and container image scanning - dependabot.yml had no npm ecosystem entry for explorer/, so its lockfile was never watched - exactly why the brace-expansion/nanoid CVEs fixed in #1280 went undetected. Add it, mirroring the existing pip entry's schedule/labels/reviewer conventions. - New container-scan.yml builds the root Dockerfile's image and scans it with Trivy (CRITICAL/HIGH OS+lib CVEs, SARIF to the Security tab) and Syft (SPDX SBOM artifact), on push to main, weekly, and manual dispatch. Neither the base-image scan nor an SBOM existed before - Dependabot's docker entry only bumps the base image tag, it doesn't scan built layers. - Trivy runs report-only for now (no exit-code gate): this is its first run against the image, so the CRITICAL/HIGH baseline hasn't been triaged yet. Once reviewed, add exit-code: '1' to make it a hard gate, same as Safety/Bandit-HIGH in security-scan.yml. * fix: run Trivy via digest-pinned image, not the aquasecurity/trivy-action wrapper verify-action-pins.sh failed in CI: the aquasecurity GitHub org has an IP allow list on its API that 403s the live tag->SHA resolution from Actions-runner IPs (confirmed reproducible, not transient - resolves fine from a non-blocked host). Rather than carve a skip exception into the pin verifier for an org this script already flags as a past tag-repointing target (see its "LiteLLM/Trivy 2026 incident" comment), pull Trivy as a sha256-digest-pinned Docker Hub image instead. A digest is immutable and verifiable independently of GitHub's API entirely, so it sidesteps the IP block without weakening verification of the one action this repo already treats as higher-risk. Confirmed the pinned digest (aquasec/trivy@sha256:62b1e65e...) resolves live against Docker Hub's registry API. * fix: match container-scan.yml's push paths to what actually reaches the image The path filter only watched explorer/package.json and package-lock.json, but Dockerfile COPYs the whole explorer/ tree plus README.md, LICENSE, and MANIFEST.in, and .dockerignore controls all of it. A frontend source change or a README/LICENSE edit would change the built image without triggering a scan, silently drifting until the next weekly run. Replace the filter with exactly .dockerignore's opt-in list.