compliance-scanner-agent

sharang/compliance-scanner-agent

Fork 0

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	20067fcf44	fix(deps): bump h2 0.4.13 -> 0.4.19 (RUSTSEC-2026-0258, unblocks CI audit) CI / Check (push) Skipped CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy Docs (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details CI / Check (pull_request) Successful in 8m59s Details The CI Security Audit step fails on RUSTSEC-2026-0258 — "h2 unbounded empty DATA frames" (DoS), fixed in h2 >= 0.4.16. h2 is a transitive dependency (hyper/reqwest), so this is a lockfile-only bump; no Cargo.toml or code change, diff limited to the single version line. The remaining audit findings (anyhow, git2, lru) are `unsound` warnings, not vulnerabilities, and do not fail the step. Folded into this CI-fix PR because the audit gate blocks every PR from going green, including this one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 18:59:00 +02:00
Sharang ParnerkarandClaude Fable 5	b5c33bdd52	fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI) CI / Check (push) Skipped CI / Deploy Docs (pull_request) Skipped Details CI / Detect Changes (pull_request) Skipped Details CI / Deploy Agent (pull_request) Skipped Details CI / Deploy Dashboard (pull_request) Skipped Details CI / Deploy MCP (pull_request) Skipped Details CI / Check (pull_request) Failing after 6m53s Details The private git-dependency still pointed at ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which is stale two ways: #231 repointed the host to git.breakpilot.com, and the repo was renamed tramiton -> firmwerk. The CI `insteadOf` rewrite is keyed on git.breakpilot.com, so it never matched the old host and Cargo fell back to a raw SSH clone of a dead host -> "Host key verification failed" -> "failed to get tramiton-core as a dependency". This broke `CI / Check` and every Deploy job on main and all PRs. Repoint the three git-deps (tramiton-core/-repro/-sbom) to ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 = same commit ae4fc137, where the crates are still named tramiton-), and update the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code change. Migrating the deps to the firmwerk- crates at a newer tag is a follow-up. Validated: `cargo fetch` + `cargo metadata --offline` resolve the dep from the new URL; resolved source is git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv	2026-08-31 18:22:52 +02:00

Author

SHA1

Message

Date

Sharang ParnerkarandClaude Fable 5

20067fcf44

fix(deps): bump h2 0.4.13 -> 0.4.19 (RUSTSEC-2026-0258, unblocks CI audit)

CI / Check (push) Skipped

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy Docs (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

CI / Check (pull_request) Successful in 8m59s

Details

The CI Security Audit step fails on RUSTSEC-2026-0258 — "h2 unbounded empty
DATA frames" (DoS), fixed in h2 >= 0.4.16. h2 is a transitive dependency
(hyper/reqwest), so this is a lockfile-only bump; no Cargo.toml or code change,
diff limited to the single version line. The remaining audit findings (anyhow,
git2, lru) are `unsound` warnings, not vulnerabilities, and do not fail the step.

Folded into this CI-fix PR because the audit gate blocks every PR from going
green, including this one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

2026-08-31 18:59:00 +02:00

Sharang ParnerkarandClaude Fable 5

b5c33bdd52

fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI)

CI / Check (push) Skipped

CI / Deploy Docs (pull_request) Skipped

Details

CI / Detect Changes (pull_request) Skipped

Details

CI / Deploy Agent (pull_request) Skipped

Details

CI / Deploy Dashboard (pull_request) Skipped

Details

CI / Deploy MCP (pull_request) Skipped

Details

CI / Check (pull_request) Failing after 6m53s

Details

The private git-dependency still pointed at
ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which is stale two
ways: #231 repointed the host to git.breakpilot.com, and the repo was renamed
tramiton -> firmwerk. The CI `insteadOf` rewrite is keyed on git.breakpilot.com,
so it never matched the old host and Cargo fell back to a raw SSH clone of a dead
host -> "Host key verification failed" -> "failed to get tramiton-core as a
dependency". This broke `CI / Check` and every Deploy job on main and all PRs.

Repoint the three git-deps (tramiton-core/-repro/-sbom) to
ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 =
same commit ae4fc137, where the crates are still named tramiton-*), and update
the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code
change. Migrating the deps to the firmwerk-* crates at a newer tag is a
follow-up.

Validated: `cargo fetch` + `cargo metadata --offline` resolve the dep from the
new URL; resolved source is git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

2026-08-31 18:22:52 +02:00

Compare commits

Diff Content Not Available