mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 04:36:40 +00:00
kevinveenbirkenbachandClaude Opus 5.5
65863a2b20
A suppression entry under <service>.security.suppressions now names either one CVE (id) or one image tag (image_tag), each with until. An image_tag entry accepts every finding of the service's image while the owner runs that tag; each owner of a shared digest is judged by its own tag (Config.Image at runtime, the pinned version in the mirror scan), so a container on any other tag stays unsuppressed. Host suppressions are the id entries of the engine services; an image_tag entry there covers the engine's own image. The cve lint requires image_tag to equal the service's version, and the Docker image updater drops a service's image_tag entries with their markers when it moves the service to another version, so a tag suppression never outlives its tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Test guidance 🧪
This directory contains contributor guidance for automated tests. Its scope is how lint, unit, integration, regression, and Playwright coverage should be structured, selected, and validated.