mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-13 22:26:49 +00:00
kevinveenbirkenbachandClaude Opus 5.5
f1cd68ea38
The maintainer decided on 2026-11-12 that CRITICAL hlth-runtime findings no longer fail a development or CI deploy but are tracked as issues. The mirror scan already files vulnerability issues for 23 of the 41 images main run 43131801262 reported; 18 images and the host CVEs had no issue path. - The report-main-failures job of call-orchestrator.yml now runs on every main run; its failure report still runs only when a deploy failed or was cancelled. A new step runs cli.meta.ci.runtime_vulnerabilities. - That module downloads the rescue-diagnostics artifacts every deploy uploads, reads the hlth-runtime finding lines and events from their journals and syncs them through cli.contributing.security.issues under the label vulnerability-runtime: one issue per image (titled like the mirror scan) and one per host distro. - An issue closes only when a deploy of the run scanned its target without an engine error and reported nothing, so chunked or cancelled runs close nothing they did not scan. - cli.contributing.security.issues gains a Tracker (label, source line, close rule); MIRROR keeps the old behaviour, and the head line now ends in per-severity CVE counts. Tests: 49 green across the runtime, issues and report_failures modules; 6 of 6 mutants caught (shared label, closing unscanned targets, ignoring engine errors, a PR ref passing the main guard, no severity counts, no dash for a missing fix). Residuals: not yet run on a real main run; the new head line adds one comment and a body edit to every open vulnerability issue on the next cron run; one engine per CI row can make an issue close and reopen; an image with a mirror issue gets a second issue under the other label. 🎯 Fix: 85 % 💥 Break: 6 % 💸 Cost: – ⏱️ Time: – 🛡️ Security: ~100 % 🏆 Score: 80 🚦 Gate: ⛔ fix 85 % < 90, break 6 % > 5 (operator approved) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI 🤖
Introspection for continuous-integration output: parse and summarise the metrics the deploy workflows emit so they can be inspected locally or published as artefacts.