platform/portal
2
0
Fork 0
Code Issues 1 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

fix(ci): docker:27-cli image job; clear postcss and sharp HIGHs #24

Merged
sharang merged 1 commits from fix/ci-image-docker-cli-and-cves into main 2026-08-31 15:51:42 +00:00
Conversation 0 Commits 1 Files Changed 3
+268 -220
sharang commented 2026-08-31 15:44:52 +00:00
Owner
Copy Link
Copy Source

Unblocks the portal image build that the tenant-registry flip is waiting on.

  1. shared job was red: trivy flagged postcss 8.4.31 (CVE-2026-45623, CVE-2026-73646) and sharp 0.34.5 (GHSA-f88m-g3jw-g9cj). Bumped the pnpm overrides; lockfile now resolves postcss 8.5.26 / sharp 0.35.4. Local trivy scan of the lockfile is clean.

  2. image job would have failed next: docker/login-action and build-push-action need a docker binary the default job container lacks (exact failure from tenant-registry run 5441). Rewrote it on the proven compliance build-push-deploy pattern: container docker:27-cli, plain docker login/build/push, cosign, HMAC-signed orca webhook over plain http.

Local checks: lint, typecheck, vitest 100% coverage, next build all pass.

Unblocks the portal image build that the tenant-registry flip is waiting on. 1. shared job was red: trivy flagged postcss 8.4.31 (CVE-2026-45623, CVE-2026-73646) and sharp 0.34.5 (GHSA-f88m-g3jw-g9cj). Bumped the pnpm overrides; lockfile now resolves postcss 8.5.26 / sharp 0.35.4. Local trivy scan of the lockfile is clean. 2. image job would have failed next: docker/login-action and build-push-action need a docker binary the default job container lacks (exact failure from tenant-registry run 5441). Rewrote it on the proven compliance build-push-deploy pattern: container docker:27-cli, plain docker login/build/push, cosign, HMAC-signed orca webhook over plain http. Local checks: lint, typecheck, vitest 100% coverage, next build all pass.
sharang added 1 commit 2026-08-31 15:44:52 +00:00
fix(ci): docker:27-cli image job; clear postcss and sharp HIGHs
ci / e2e (pull_request) Blocked by required conditions
Details
ci / shared (pull_request) Successful in 13s
Details
ci / test (pull_request) Successful in 10m18s
Details
ci / image (pull_request) Skipped
Details
881ef7b46a 
Two fixes to make main ship an image again:

1. The image job used docker/login-action + build-push-action, which need
   a docker binary the runner's default job container does not have (the
   exact failure tenant-registry hit in run 5441). Rebuilt on the proven
   compliance build-push-deploy pattern: container docker:27-cli, plain
   docker login/build/push, cosign, then the HMAC-signed orca webhook
   over plain http like the proven compliance trigger-orca job.
2. trivy gate: postcss 8.4.31 (CVE-2026-45623, CVE-2026-73646) and sharp
   0.34.5 (GHSA-f88m-g3jw-g9cj) via pnpm overrides; lockfile resolves
   postcss 8.5.26 / sharp 0.35.4. Local trivy scan is clean; lint,
   typecheck, 100% coverage and build all pass locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD
sharang merged commit ac28e2256f into main 2026-08-31 15:51:42 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: platform/portal#24