semantica

mirror of https://github.com/semantica-agi/semantica.git synced 2026-08-29 04:26:20 +00:00

Files

T

KaifAhmad1 ef74ecf3a8 fix(ci): remove Knative pod-level securityContext and fix Bicep null ternary

checkov crashes (exit 1) on two constructs introduced in earlier commits:

1. deploy/gcp/cloudrun-service.yaml: pod-level spec.template.spec.securityContext
   is not part of Knative RevisionSpec. checkov's Knative parser panics on
   this unknown field. Remove it — CKV_K8S_28 (seccomp) and CKV_K8S_30
   (AppArmor) are already satisfied by the legacy annotations in
   spec.template.metadata.annotations; the container-level securityContext
   that IS valid in Cloud Run Gen 2 is kept.

2. deploy/azure/main.bicep: 'vnetInternal ? { ... } : null' compiles to
   ARM null() which crashes checkov's Bicep/ARM parser. Replace the inline
   null ternary with two concrete variable objects (vnetConfigInternal and
   vnetConfigExternal) so both branches are well-typed objects.

2026-06-24 13:41:28 +05:30

azure

fix(ci): remove Knative pod-level securityContext and fix Bicep null ternary

2026-06-24 13:41:28 +05:30

fly

fix(deploy): harden security in deployment templates and explorer app

2026-06-24 12:51:09 +05:30

gcp

fix(ci): remove Knative pod-level securityContext and fix Bicep null ternary

2026-06-24 13:41:28 +05:30

helm

fix(ci): fix 2 remaining checkov HIGH findings and Terrascan seccomp warnings