mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-14 06:37:25 +00:00
kevinveenbirkenbachandClaude Opus 5.5
1e1d37d679
The scan threshold becomes a severity-to-verdict mapping in roles/sys-ctl-hlth-runtime/meta/services.yml, CRITICAL: fail and HIGH: warn, for production and CI alike. A finding mapped to fail fails the service and the deploy, a warn prints a warning line and passes, a suppressed one prints an info line. Engine errors, missing databases and PHP hardening violations still fail. The old list form is rejected with a config error. The daily mirror scan stays strict: every unsuppressed fail or warn finding is a row, so it fails while an image is red. Every run publishes one list of judged findings four ways: - report.json of the latest run (summary + records) under DIR_HEALTH_RUNTIME_REPORT, written atomically; - findings.jsonl under DIR_HEALTH_RUNTIME_LOG, one record per finding, appended per run and rotated weekly by a logrotate drop-in; - one JSON line per target plus a summary line on stdout for the journal; - infinito_hlth_runtime.prom in DIR_METRICS_TEXTFILE when web-app-prometheus is deployed: findings per target, kind, image, severity, scanner and verdict (no CVE label), last run time and success, scanner errors. Each record carries run_id, timestamp, host, environment, target, kind, image, scanner, id, severity, package, installed_version, fixed_version, suppressed, suppressed_until and verdict. The paths are SPOT variables in group_vars/all/05_paths.yml, the script takes them as arguments. Requirement 070 and the role README describe the mapping, the outputs and the per-image vulnerability issue of the previous commit. Part of #1324 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>