Support stable source finding reviews with explicit occurrence counts #62

Merged

gitchegumi merged 1 commit from kiyi/stable-source-reviews into main

2026-09-25 23:42:22 -05:00

kiyi commented

2026-09-25 23:36:11 -05:00

Member

Change

Add optional positive integer occurrences to stable source selectors (scanner, rule/CVE, path and severity). The default remains one occurrence. A reviewed count supports existing repeated findings in the same file while added/removed matches still block. Duplicate selectors and invalid counts are rejected; expiry, secret/malware blocking and image review rules remain enforced.

This supports the owner-directed platform policy migration following platform run 4190. Mitigation matching does not depend on commit or artifact hashes or source-line positions.

Validation

Six focused source-policy tests pass, including line movement, count changes, invalid values, duplicate selectors, expiry and secret blocking.
Replay of the Kubernetes-only Trivy 0.74.0 embedded-check findings against the proposed platform policy accepts its 30 reviewed IaC occurrences; the known source CVE also matches its stable selector. Changed rule/path/severity and an extra occurrence are rejected.
git diff --check passed. No local container build or runtime test was performed.

Release

After review, merge to protected main and use this repository's Publish workflow release Action to publish the next unused minor release, planned as v1.22.0. The dependent platform caller/policy migration must wait for that immutable release. No release or deployment was dispatched.

## Change Add optional positive integer `occurrences` to stable source selectors (scanner, rule/CVE, path and severity). The default remains one occurrence. A reviewed count supports existing repeated findings in the same file while added/removed matches still block. Duplicate selectors and invalid counts are rejected; expiry, secret/malware blocking and image review rules remain enforced. This supports the owner-directed platform policy migration following [platform run 4190](https://git.gitchegumi.com/Homelab/platform/actions/runs/4190/jobs/1/attempt/1). Mitigation matching does not depend on commit or artifact hashes or source-line positions. ## Validation - Six focused source-policy tests pass, including line movement, count changes, invalid values, duplicate selectors, expiry and secret blocking. - Replay of the Kubernetes-only Trivy 0.74.0 embedded-check findings against the proposed platform policy accepts its 30 reviewed IaC occurrences; the known source CVE also matches its stable selector. Changed rule/path/severity and an extra occurrence are rejected. - git diff --check passed. No local container build or runtime test was performed. ## Release After review, merge to protected main and use this repository's **Publish workflow release** Action to publish the next unused minor release, planned as **v1.22.0**. The dependent platform caller/policy migration must wait for that immutable release. No release or deployment was dispatched.

kiyi added 1 commit

2026-09-25 23:36:11 -05:00

Support stable source reviews with explicit occurrence counts

Workflow acceptance / acceptance (pull_request) Successful in 2m8s

Details

Repository security / security-1 (pull_request) Successful in 2m57s

Details

Library checks / tests (pull_request) Successful in 5m17s

Details

bf11f0c844