WIP: build: patch vulnerable application image dependencies #187
No reviewers
Labels
No labels
auth
autorelease: pending
autorelease: tagged
bug
dependencies
devops
docker
documentation
duplicate
enhancement
github_actions
good first issue
help wanted
invalid
javascript
maintenance
question
refactor
ui
wontfix
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
gitchegumi/GitchAlerts!187
Loading…
Reference in a new issue
No description provided.
Delete branch "build/patch-image-dependencies"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Deployment run 79 found eleven vulnerability occurrences across the current web, ingress and worker images. Commit
a9654a7updates Next.js/@next/env to 16.3.8, ajv > fast-uri to 3.1.8, express > proxy-addr to 2.0.8, next > sharp to 0.35.5 and source-map-js to 1.2.2. The regenerated pnpm 9 lock includes patched Sharp platform binaries/libvips. Advisory links and the publication dependency are recorded in docs/security-scans.md.All reusable workflow callers now use stable-v1, preserving their existing workflow/job names. The required native Gitleaks 8.30.1 hook is integrated with staged Prettier, installed clone-locally in the shared Git directory, and fails on missing/wrong scanners or scan errors. The prepare step skips hook installation in hosted CI while retaining CI scans.
Local validation: Prisma generation, all workspace type checks/lint, 397 existing tests, and the production workspace build passed. Changed-file formatting/diff checks and seven synthetic staged-secret/override/redaction cases passed; the actual commit ran Prettier and native Gitleaks successfully. No local container execution. Hosted CI/container builds and full image scans remain required.
Draft pending hosted validation/review. After merge, use the existing release automation to publish new versioned images for all three services, then adopt verified immutable digests through Homelab/GitchAlerts #17 and its full image gate. The existing 0.12.4 images remain blocked. No database migration, environment change or provider reconnection is needed. Redis stays in use; its OpenSSL patch is owned by Homelab/base-images, and Valkey migration remains separate.
Refs: Homelab/GitchAlerts#17 and https://git.gitchegumi.com/Homelab/GitchAlerts/actions/runs/79/jobs/1/attempt/1
The
validatejob was already present on main; this PR retained its bespoke setup while changing the reusable security callers. I should have addressed that setup. Run 84 fails inactions/setup-nodeonEACCES: mkdir /opt/hostedtoolcache, before pnpm, formatting, lint or tests execute.The workspace-root AGENTS.md now explicitly requires all application/infrastructure workflow implementations to come from Homelab/workflows, with thin callers only. The shared replacement is prepared in Homelab/workflows#99, commit
426ca3be14360c009c6f911fc64c0fb3291ebb4f: one combined validation job with a writable job-local Node cache and required format/typecheck/lint/test/build stages.The proposed #187 caller patch preserves CI triggers/job IDs, requests the existing display name and omits optional
library_ref. Its caller contract, formatting and all 398 existing tests passed locally; 18 shared Node/channel checks also passed. The caller is prepared locally and has not been pushed becausenode-ci.ymlmust first be reviewed, released and promoted to stable-v1. After promotion, a fresh owning run must verify setup and the exact existing required status before this workflow issue is closed. Hosted acceptance remains pending.View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.