0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 20:26:33 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 6b36c8579a fix(sys-ctl-hlth-runtime): scan with Trivy, Grype and OSV instead of PHP floors

The runtime check judged PHP by its upstream version and failed every
container on an end-of-life line. Distribution builds backport fixes without
raising that number, so main run 41154895895 failed Checkmk#0 on
`PHP 8.1.2-1ubuntu2.28 runs the end-of-life line 8.1`, a build Ubuntu lists
as fixed for CVE-2026-109618 and CVE-2026-109619.

- The role now runs Trivy, Grype and OSV-Scanner, with a Syft SBOM per
  target, against the host and the images of the running containers, in
  bounded parallel lanes. Targets, engines and the failing severities are
  lists in meta/services.yml; the default is every target and engine at
  CRITICAL and HIGH with a fix available.
- Grype always scans the binary-classified packages of the SBOM, so a PHP
  built from source in an official php image (8.4.26) still fails on the
  CVEs fixed in 8.4.27, which Trivy and OSV do not see.
- OSV reads an SBOM copy whose distro purls carry the source package name.
- A CVE is suppressed only in the role owning the image, under
  services.<service>.security.suppressions with id, until and a
  `# nocheck: cve <reason>` marker; a lint rejects bare, malformed and
  expired entries.
- The deploy-time run fails on its first finding: sys-service gains
  system_service_run_once and sys-service-terminator skips the retries
  only for those units. The timer runs daily at 00:00 UTC.
- The PHP version floors are removed; the php_hardening check stays.
- make test-security replaces make security-runtimes: Syft builds an SBOM
  of every pinned image straight from the GHCR mirror, cached by digest,
  and the three engines scan it with the role's threshold and suppressions.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 02:44:58 +01:00

5.9 KiB

Raw Blame History

Testing and Validation ✅

Use the real commands from the repository. Run them from the repository root.

This repository uses several test and validation types:

Lint and syntax checks catch style, formatting, and Ansible syntax problems early.
Unit tests verify isolated logic.
Integration tests verify behavior across modules and runtime boundaries.
External tests verify live third-party state such as public registries or services when hermetic checks are insufficient.
Combined validation runs the standard main verification flow.
Local deploy and E2E validation checks whether apps and deployment flows work in a realistic local stack.

Code Quality and Automated Checks 🔎

Use the following table to choose the right lint, syntax, unit, integration, or combined validation command for your change.

Validation Commands 🛠️

Category	Command	What it does	When to use it
Lint	`make lint`	Runs the main lint checks for the repository.	Use this when you want a broad lint pass before pushing.
Syntax	`make lint-ansible`	Runs the Ansible syntax validation for `playbook.yml`.	Use this when you changed Ansible roles, inventories, or playbook-related files.
Lint tests	`make test-lint`	Runs the lint test suite inside the development environment.	Use this when you want CI-like lint validation.
Unit tests	`make test-unit`	Runs the unit test suite.	Use this when you changed Python logic or other isolated code paths.
Integration tests	`make test-integration`	Runs the integration test suite.	Use this when your change affects behavior across modules or runtime boundaries.
External tests	`make test-external`	Runs opt-in tests that depend on live third-party systems such as public registries.	Use this when you need live external verification. It is intentionally excluded from `make test`.
Security tests	`make test-security`	Builds a Syft SBOM of every pinned role image from the GHCR mirror and scans it with Trivy, Grype and OSV at the threshold of `sys-ctl-hlth-runtime`.	Use this when you bump or add an image pin. It is excluded from `make test` and runs daily in `cron-images-mirror-all.yml`.
Combined validation	`make test`	Runs the main combined validation flow without the opt-in external suite.	Use this whenever a change touches at least one file that is not `.md` or `.rst`, or before opening a Pull Request.

Local Deploy and End-to-End Checks 🚀

For the retry-loop policy, use Compose Loop as the SPOT. The table below is a command reference for the supported local deployment paths.

Local Validation Commands 🏠

Use the following table when you need realistic local deployment validation or app-level end-to-end checks.

Category	Command	What it does	When to use it
Local deploy	`make compose-deploy apps=web-app-nextcloud`	Creates the needed inventory and deploys one or more apps.	Fresh deploy for a specific app set.
Local deploy	`make compose-deploy mode=update apps=web-app-nextcloud`	Reuses an existing `devices.yml` inventory and redeploys one or more apps quickly.	Fast reuse path.
Local deploy	`make compose-deploy mode=update apps=web-app-nextcloud purge=true`	Reuses an existing `devices.yml` inventory, purges the entity first, and redeploys one or more apps quickly.	Fast reuse path after a state reset.
Local deploy and E2E	`make compose-deploy mode=reinstall apps=web-app-matomo`	Runs a dedicated local validation flow for one or more apps against the dev stack, cycling the stack and re-initializing the inventory first.	Baseline and recovery path.
Full local validation	`make compose-deploy`	Builds the broader local deployment flow across apps.	Broad coverage when you explicitly need it.
Bundle deploy	`make compose-deploy bundles="<bundle>[,<bundle>]"`	Aggregates the role groups from one or more inventories/bundles/ entries into `apps` and runs the reinstall flow. Set `full_cycle=true` for the async update pass.	One-shot validation of a curated app shape (e.g. `education-suite`).
Bundle redeploy	`make compose-deploy mode=update bundles="<bundle>[,<bundle>]"`	Same bundle resolution as the bundle deploy, but routes through the reuse path (no down/up, no entity purge).	Fast iteration loop after a prior bundle deploy.
Local reset	`make compose-inventory-refresh`	Recreates the local inventory without deploying apps.	Use this when your local inventory is broken or you want a clean reset.
Local cleanup	`make compose-system-purge`	Deletes local deploy artifacts and cleanup data.	Use this only when you really want to remove local state.

Important:

Some local deploy commands are destructive.
Read reset/README.md, purge/README.md, or exec/README.md before using the matching helper.
For act-based workflow checks, see Act Workflow Checks.
After a successful local deploy, run make network-trust-ca and restart your browser.

Suite Selection 🎯

When exactly one test file changes inside one test family, you MAY scope the run with INFINITO_TEST_PATTERN.
When two or more test files change inside the same test family, you MUST run the matching suite command without INFINITO_TEST_PATTERN: make test-lint, make test-unit, make test-integration, or make test-external.
When a change touches multiple test families, you MUST run every affected suite.

Testing Standards 📋

For test-type-specific requirements, framework, and creation procedures see:

5.9 KiB Raw Blame History