fix(ci): make main deployable again — coverage, CVEs, and the image job #22

2026-08-30T21:16:15Z

sharang commented

2026-08-30 21:16:15 +00:00

Found while preparing the tenant-registry enforcement flip: the deployed portal image is from June 10, so the service-token code merged in #21 never shipped — flipping tenant-registry now would have broken every portal page.

Three independent defects, one PR because together they are 'main cannot ship':

The image job has never run. Its job-level hashFiles('Dockerfile') evaluates before checkout against an empty workspace — always false. Same bug fixed in tenant-registry#16 today.
The test job was red on #21's merge — this repo pins 100% function/branch coverage and my local verification skipped --coverage (my miss). Closed for real rather than lowered: removed two dead json() arrows from mocks the code never reads, added a test for the expires_in ?? 300 default-lifetime branch. 80 tests, 100/100/100/100.
The trivy gate was red on 14 real findings (3 CRITICAL) — including CVE-2026-73420 in @auth/core 0.37.2, a Unicode-normalization email homoglyph bypass in the exact auth library this rollout depends on. @auth/core -> 0.41.3, next -> 16.2.11, next-auth -> 5.0.0-beta.30, nanoid/postcss via pnpm overrides. Typecheck, lint (--max-warnings 0) and production build clean on the new versions.

Note: admin-compliance pins the same next-auth beta-25 — the @auth/core CVE applies there too; mirrored bump to follow separately.

🤖 Generated with Claude Code

Found while preparing the tenant-registry enforcement flip: the deployed portal image is from **June 10**, so the service-token code merged in #21 never shipped — flipping tenant-registry now would have broken every portal page. Three independent defects, one PR because together they are 'main cannot ship': 1. **The image job has never run.** Its job-level `hashFiles('Dockerfile')` evaluates before checkout against an empty workspace — always false. Same bug fixed in tenant-registry#16 today. 2. **The test job was red on #21's merge** — this repo pins 100% function/branch coverage and my local verification skipped `--coverage` (my miss). Closed for real rather than lowered: removed two dead `json()` arrows from mocks the code never reads, added a test for the `expires_in ?? 300` default-lifetime branch. 80 tests, 100/100/100/100. 3. **The trivy gate was red on 14 real findings (3 CRITICAL)** — including CVE-2026-73420 in @auth/core 0.37.2, a Unicode-normalization email homoglyph bypass in the exact auth library this rollout depends on. @auth/core -> 0.41.3, next -> 16.2.11, next-auth -> 5.0.0-beta.30, nanoid/postcss via pnpm overrides. Typecheck, lint (--max-warnings 0) and production build clean on the new versions. Note: admin-compliance pins the same next-auth beta-25 — the @auth/core CVE applies there too; mirrored bump to follow separately. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-08-30 21:16:17 +00:00

fix(ci): make main deployable again — coverage, CVEs, and the image job

ci / e2e (pull_request) Blocked by required conditions

Details

ci / shared (pull_request) Failing after 13s

Details

ci / test (pull_request) Successful in 10m18s

Details

ci / image (pull_request) Skipped

Details

55b42d7dbe

Found while preparing the tenant-registry enforcement flip: the deployed
portal image is from June 10, so the service-token code merged in #21
never shipped — flipping tenant-registry would have broken every portal
page. Three independent defects:

1. The image job's job-level hashFiles('Dockerfile') condition evaluates
   BEFORE checkout against an empty workspace — always false, job
   silently skipped on every main push. Same bug just fixed in
   tenant-registry (#16).

2. The test job was red on #21's merge: this repo pins 100%
   function/branch coverage and my local run skipped --coverage. Closed
   for real, not lowered: two dead json() arrows removed from mocks the
   code never reads (it throws on !ok before touching the body), and a
   new test exercising the expires_in ?? 300 default-lifetime branch.
   80 tests, 100/100/100/100.

3. The shared job's trivy gate was red on 14 real findings (3 CRITICAL):
   @auth/core 0.37.2 -> 0.41.3 (CVE-2026-73420, Unicode-normalization
   email homoglyph bypass — in the auth library this rollout depends on),
   next 16.2.6 -> 16.2.11, nanoid + postcss via pnpm overrides.
   next-auth 5.0.0-beta.25 -> beta.30; typecheck, lint and build clean
   on the new versions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang referenced this issue from a commit

2026-08-30 21:20:32 +00:00

fix(deps): patch the @auth/core CRITICAL in the admin panel's auth stack

sharang referenced this issue from a commit

2026-08-30 21:20:52 +00:00

rbac-auth5: flip tenant-registry enforcement ON (first flip in the cluster)

sharang merged commit ba483cae97 into main

2026-08-30 21:33:10 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: platform/portal#22