moebiusol/oculus_vita-cms
4
0
Fork 0
Code Issues Pull requests 21 Projects Releases Packages 1 Wiki Activity Actions

[FIX] OCV-206 CMS Snyk Advisory and Mandatory Grype SBOM Gate #2

Open
moeardent wants to merge 17 commits from fix/OCV-206-cms-snyk-advisory-doc into dev
pull from: fix/OCV-206-cms-snyk-advisory-doc
merge into: moebiusol:dev
Conversation 0 Commits 17 Files changed 16 +1108 -128
moeardent commented 2026-10-09 02:21:57 +00:00
Owner
Copy link

Summary

  • Change class: FIX
  • Promotion target: dev
  • Trace ref: OCV-206
  • Related review / risk / verification refs: This review request; local contract and static verification listed below.

Scope

Included

  • Keep Snyk fully advisory and harden validation so nested or malformed vulnerability reports and malformed SARIF cannot be labeled clean.
  • Add mandatory Grype scans over the existing source and exact-image Syft SBOMs; publish separate JSON reports and block on high/critical findings or unusable scan evidence.
  • Update active TeamCity wiring, CI/security documentation, OCV-206 spec/evidence, and focused regression tests.

Out of scope

  • Merge, deployment, PROD, changing Snyk to a gate, adding a Grype version pin/toolchain, or asserting a signing control.
  • Defining a new Grype database-freshness policy; Grype-reported missing/stale/unusable DB blocks only when it makes the scan fail or unusable.

Implementation Notes

  • Key changes: snyk_gate_summary.py validates all SARIF runs and top-level vulnerability report shapes while all Snyk outcomes stay non-blocking. run_grype.sh validates non-empty Syft artifacts and Grype match details, removes stale output before scanning, invokes --fail-on high, and fails on missing CLI, nonzero scan, or malformed/empty evidence. TeamCity runs Grype after source and image SBOM generation.
  • Contracts or boundaries touched: TeamCity CI step/status contexts, advisory summary validity, and machine-readable Grype evidence.
  • Data or schema impact: Grype JSON reports are written to artifacts/ci/grype/medcms-{source,image}.grype.json.
  • Operational impact: CI relies on the existing ci-ops runner Grype executable; this PR adds no cross-system tool pin.

Verification Evidence

  • Checks run: Snyk advisory contract tests 10/10; Grype gate contract tests 7/7; all repository *_static_checks.py; Bash syntax; Python byte-compilation; git diff --check.
  • Manual verification: TeamCity order places each Grype scan after its corresponding Syft SBOM step; Snyk remains advisory.
  • Evidence artifacts or links: exact head 008271cbc83fefd84f05cde222f1af19d588961c; TeamCity build 19882 was assigned to prior head 41e1db2f58b9f96c8cd591424a11a2908c0b498a and is not evidence for this head.
  • Residual risks: Protected exact-head Validate/Qodana and source/image Grype execution remain pending. The current execution agent cannot read/queue TeamCity because its REST credential returns HTTP 403; an authorized CI operator must verify agent availability, DB usability, and actual source/image reports before merge.

Documentation and QMS Impact

  • Docs updated: docs/CI.md, ci/teamcity/README.md, and staging security policy.
  • Controlled records updated: OCV-206 bugfix/design/tasks/verification pack.
  • Release evidence impact: adds a mandatory source/image SBOM vulnerability gate; Snyk remains advisory.
  • Exception or deviation refs: None.
  • Documentation trigger checker output: Not applicable to this repository guidance change.
  • Documentation authority registry validation: QMS engineering, source-control, change-control, and release-evidence controls were consulted.
  • Documentation obligation pack: OCV-206 controlled delivery pack.
  • Trigger decision record: specs/ocv-206-cms-snyk-always-advisory/bugfix.md.
  • Required product-bound records: None triggered; no product behavior or intended-use change.
  • Not-triggered rationale approvals: Not applicable.

Reviewer Focus

  • Verify malformed Syft/Grype entries fail closed and valid current Syft/Grype output is accepted.
  • Verify exact-head CI exercises actual Grype availability/DB and both source/image SBOM gates.
  • Confirm every Snyk token/license/org/quota/service/tool/findings/malformed-output outcome remains warning-only.
  • Check TeamCity status-context documentation matches active configuration; no signing gate is claimed.

Promotion and Recovery

  • Intended next step after approval: Complete exact-head protected CI and independent review; merge only after both pass.
  • Rollback or recovery shape: Revert this source-change commit set; no environment mutation is included.
  • Environment notes: DEV validation only; no deployment or PROD action authorized.

Identity and Traceability

  • Human sponsor principal: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
  • Human sponsor Authentik user: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
  • Executing agent identity: Moe Ardent moe.lorand.bot@moebiusol.eu
  • Agent role: execution specialist
  • Installation: moe-worklap1 (cca69378-c202-4b08-9cfd-c99cef29779a)
  • Companion command id: Not applicable

Closure Checklist

  • scope is described and bounded
  • local verification evidence is attached or linked
  • docs and QMS impact is stated
  • reviewer focus areas are called out
  • promotion target is explicit
  • rollback or recovery path is stated
## Summary - Change class: FIX - Promotion target: `dev` - Trace ref: [OCV-206](https://moebiusol.youtrack.cloud/issue/OCV-206) - Related review / risk / verification refs: This review request; local contract and static verification listed below. ## Scope ### Included - Keep Snyk fully advisory and harden validation so nested or malformed vulnerability reports and malformed SARIF cannot be labeled clean. - Add mandatory Grype scans over the existing source and exact-image Syft SBOMs; publish separate JSON reports and block on high/critical findings or unusable scan evidence. - Update active TeamCity wiring, CI/security documentation, OCV-206 spec/evidence, and focused regression tests. ### Out of scope - Merge, deployment, PROD, changing Snyk to a gate, adding a Grype version pin/toolchain, or asserting a signing control. - Defining a new Grype database-freshness policy; Grype-reported missing/stale/unusable DB blocks only when it makes the scan fail or unusable. ## Implementation Notes - Key changes: `snyk_gate_summary.py` validates all SARIF runs and top-level vulnerability report shapes while all Snyk outcomes stay non-blocking. `run_grype.sh` validates non-empty Syft artifacts and Grype match details, removes stale output before scanning, invokes `--fail-on high`, and fails on missing CLI, nonzero scan, or malformed/empty evidence. TeamCity runs Grype after source and image SBOM generation. - Contracts or boundaries touched: TeamCity CI step/status contexts, advisory summary validity, and machine-readable Grype evidence. - Data or schema impact: Grype JSON reports are written to `artifacts/ci/grype/medcms-{source,image}.grype.json`. - Operational impact: CI relies on the existing `ci-ops` runner Grype executable; this PR adds no cross-system tool pin. ## Verification Evidence - Checks run: Snyk advisory contract tests 10/10; Grype gate contract tests 7/7; all repository `*_static_checks.py`; Bash syntax; Python byte-compilation; `git diff --check`. - Manual verification: TeamCity order places each Grype scan after its corresponding Syft SBOM step; Snyk remains advisory. - Evidence artifacts or links: exact head `008271cbc83fefd84f05cde222f1af19d588961c`; TeamCity build 19882 was assigned to prior head `41e1db2f58b9f96c8cd591424a11a2908c0b498a` and is not evidence for this head. - Residual risks: Protected exact-head Validate/Qodana and source/image Grype execution remain pending. The current execution agent cannot read/queue TeamCity because its REST credential returns HTTP 403; an authorized CI operator must verify agent availability, DB usability, and actual source/image reports before merge. ## Documentation and QMS Impact - Docs updated: `docs/CI.md`, `ci/teamcity/README.md`, and staging security policy. - Controlled records updated: OCV-206 bugfix/design/tasks/verification pack. - Release evidence impact: adds a mandatory source/image SBOM vulnerability gate; Snyk remains advisory. - Exception or deviation refs: None. - Documentation trigger checker output: Not applicable to this repository guidance change. - Documentation authority registry validation: QMS engineering, source-control, change-control, and release-evidence controls were consulted. - Documentation obligation pack: OCV-206 controlled delivery pack. - Trigger decision record: `specs/ocv-206-cms-snyk-always-advisory/bugfix.md`. - Required product-bound records: None triggered; no product behavior or intended-use change. - Not-triggered rationale approvals: Not applicable. ## Reviewer Focus - Verify malformed Syft/Grype entries fail closed and valid current Syft/Grype output is accepted. - Verify exact-head CI exercises actual Grype availability/DB and both source/image SBOM gates. - Confirm every Snyk token/license/org/quota/service/tool/findings/malformed-output outcome remains warning-only. - Check TeamCity status-context documentation matches active configuration; no signing gate is claimed. ## Promotion and Recovery - Intended next step after approval: Complete exact-head protected CI and independent review; merge only after both pass. - Rollback or recovery shape: Revert this source-change commit set; no environment mutation is included. - Environment notes: DEV validation only; no deployment or PROD action authorized. ## Identity and Traceability - Human sponsor principal: 45a33291-8c6a-4e07-bdd5-131c8d44c38d - Human sponsor Authentik user: 45a33291-8c6a-4e07-bdd5-131c8d44c38d - Executing agent identity: Moe Ardent <moe.lorand.bot@moebiusol.eu> - Agent role: execution specialist - Installation: `moe-worklap1` (`cca69378-c202-4b08-9cfd-c99cef29779a`) - Companion command id: Not applicable ## Closure Checklist - [x] scope is described and bounded - [x] local verification evidence is attached or linked - [x] docs and QMS impact is stated - [x] reviewer focus areas are called out - [x] promotion target is explicit - [x] rollback or recovery path is stated <!-- migrated-from: pull-request Moebiusol/oculus_vita-cms #117 -->
- Replace the stale claim that Snyk findings fail the gate
- Document advisory scan outcomes and independent blocking controls

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
- Reject malformed/nested Snyk reports without making Snyk blocking

- Scan source and image Syft SBOMs with mandatory Grype JSON evidence

- Update OCV-206 verification, security policy, and CI documentation

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: execution specialist

Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a

Agent-Installation-Nickname: moe-worklap1

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117

Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
- Document source and image Grype status contexts from active TeamCity wiring

- Clarify failures block only when scan evidence or database is unusable

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: execution specialist

Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a

Agent-Installation-Nickname: moe-worklap1

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117

Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
- Reject Syft artifacts without semantic name/type fields

- Reject Grype matches without vulnerability and artifact details

- Add valid-JSON hostile entry regressions while keeping Snyk advisory

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: execution specialist

Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a

Agent-Installation-Nickname: moe-worklap1

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117

Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Install the current official Grype release into workspace-local tools when absent.

Keep explicit executable overrides fail closed and retain the high-severity threshold.

Add a mocked installer regression and update the OCV-206 CI verification record.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: execution specialist

Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a

Agent-Installation-Nickname: moe-worklap1

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117

Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Use only Anchore official install URL for the Grype bootstrap.

Exercise workspace installation through a mocked curl and disposable tool path.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: execution specialist

Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a

Agent-Installation-Nickname: moe-worklap1

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117

Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Keep existing production Validate and SecurityImage step definitions unchanged by limiting new mandatory Grype steps to DEV and TEST. Add an execution-level regression using a fake TeamCity API.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Add a dedicated setup mode that changes only the four DEV/TEST Grype steps, without entering global TeamCity or PROD reconciliation. Validate Grype report descriptor name/version and log the observed version without pinning.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Keep the source Grype gate at high severity while excluding only runner-local .tools from Syft directory catalogs. Add a command-contract regression preserving product/vendor scope and record scanner provenance and scope evidence.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Document that unusable scans and nonzero scanner/database failures block, while an update-check warning alone does not block when report evidence remains usable.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Record the product and current TeamCity build identity in source Syft output, include all source file digests except transient workspace tooling, and fail closed unless source or image scan inputs contain meaningful scoped evidence. Preserve package-based image scanning and add focused regressions and documentation.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Make Grype source identity contract fixtures honor the TeamCity-provided current build number so CI-level validation exercises the same fail-closed identity contract as local tests.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Match the Grype source SBOM contract to Syft directory JSON: accept expected root/directory entries, require a digested regular-file inventory when no packages are found, permit zero-byte files without digests, and reject generated tool, VCS, and build-evidence paths. Keep the image scan package-based and document the actual source inventory boundary.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Exclude generated Qodana results and IDE workspace metadata from the source Syft inventory, and reject those root paths in Grype source preflight. Add regressions using Syft root-path shapes while retaining real product/vendor source coverage. Update CI and security policy wording.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
- Record the five excluded generated or non-product roots and the 12/12 Grype contract suite.
- Label superseded scanner runs and record Validation20004 exact-head evidence.
- State that the documentation-only successor still requires exact-head CI and independent review.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
- Require terminal-green exact-head Qodana and Validation before merge.
- Keep generated build IDs and artifact links in PR/evidence provenance, not source criteria.
- Add a regression against hardcoded build IDs and stale must-rerun claims.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: execution specialist
Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a
Agent-Installation-Nickname: moe-worklap1
Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117
Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Require Snyk status and target provenance before summarizing a vulnerability report as clean. Truncated or malformed exit-zero output remains nonblocking but is explicitly recorded as unavailable; add hostile tests and update the advisory contract.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: execution specialist

Agent-Installation-Id: cca69378-c202-4b08-9cfd-c99cef29779a

Agent-Installation-Nickname: moe-worklap1

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Review-Ref: https://codeberg.org/Moebiusol/oculus_vita-cms/pulls/117

Verification-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
This pull request has changes conflicting with the target branch.
  • ci/teamcity/run_grype.sh
  • ci/teamcity/setup_oculus_vita_cms_pipeline.sh
  • docs/CI.md
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/OCV-206-cms-snyk-advisory-doc:fix/OCV-206-cms-snyk-advisory-doc
git switch fix/OCV-206-cms-snyk-advisory-doc
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: moebiusol/oculus_vita-cms#2
No description provided.
Delete branch "fix/OCV-206-cms-snyk-advisory-doc"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?