kevinveenbirkenbachandClaude Opus 5.5 043e001669 feat(ci): rotate the vulnerability engine per row and hand its databases over ...

Each CI deploy row now draws one vulnerability engine (trivy, grype or osv)
as a fifth rotation axis, shown in the job name next to distro and
filesystem (🔬 axis, 🔺 trivy, 🍇 grype, 🐙 osv). The deploy-time scan of
sys-ctl-hlth-runtime runs that engine behind Syft and the Grype runtime pass.

- A vulnerability-db job keeps one Actions cache per database and day and
  downloads only the missing ones. Every deploy job restores Grype plus its
  drawn engine, fails on a cache miss and never downloads a database itself.
- Local stacks share one host directory, INFINITO_VULNERABILITY_DB_HOST_PATH,
  mounted read-only at INFINITO_VULNERABILITY_DB_DIR in compose.yml and in
  every swarm node. A local deploy without a pinned engine draws one and
  refreshes only the databases it reads, at most once a day, under a lock.
- A pinned engine whose database is missing stops the deploy before it
  starts.

Part of #1324

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-01 02:44:58 +01:00

..

__init__.py

…

test_axes.py

feat(ci): rotate the vulnerability engine per row and hand its databases over

2026-11-01 02:44:58 +01:00

test_instructions.py

…

test_selection.py

feat(ci): deploy only the variants a change reaches

2026-09-21 22:51:03 +02:00