kevinveenbirkenbachandClaude Opus 5.5 043e001669 feat(ci): rotate the vulnerability engine per row and hand its databases over ...

Each CI deploy row now draws one vulnerability engine (trivy, grype or osv)
as a fifth rotation axis, shown in the job name next to distro and
filesystem (🔬 axis, 🔺 trivy, 🍇 grype, 🐙 osv). The deploy-time scan of
sys-ctl-hlth-runtime runs that engine behind Syft and the Grype runtime pass.

- A vulnerability-db job keeps one Actions cache per database and day and
  downloads only the missing ones. Every deploy job restores Grype plus its
  drawn engine, fails on a cache miss and never downloads a database itself.
- Local stacks share one host directory, INFINITO_VULNERABILITY_DB_HOST_PATH,
  mounted read-only at INFINITO_VULNERABILITY_DB_DIR in compose.yml and in
  every swarm node. A local deploy without a pinned engine draws one and
  refreshes only the databases it reads, at most once a day, under a lock.
- A pinned engine whose database is missing stops the deploy before it
  starts.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 02:44:58 +01:00

..

profile

…

variant

feat(ci): rotate the vulnerability engine per row and hand its databases over

2026-11-01 02:44:58 +01:00

__init__.py

refactor(python): clear the open CodeQL code-quality alerts

2026-10-20 21:40:58 +02:00

test_playwright_summary.py

style(python): import datetime as dt for ruff 0.17

2026-10-15 01:24:31 +02:00

test_pytest_summary.py

…

test_run_name.py

…