From e1de8ed985e46f99a950eadc9e0ef2b91217fb9a Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sat, 12 Sep 2026 14:43:44 -0500 Subject: [PATCH 1/2] =?UTF-8?q?fix(deps):=20cerrar=20las=20seis=20moderada?= =?UTF-8?q?s=20que=20#703=20dej=C3=B3,=20y=20que=20build-and-test=20use=20?= =?UTF-8?q?el=20mismo=20gate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #703 cerró las cinco altas (multer, js-yaml). Quedaban seis moderadas, todas con arreglo dentro del rango que declara su consumidor; se suben los pines de override que ya existían y se añade uno para qs: - hono 4.12.34 -> 4.13.7: tres advisories del parser (`toSSG()`, anidamiento sin límite en `parseBody`, query parser leyendo tras el `#`) - qs 6.15.2 -> 6.16.0: bypass del array-limit y DoS vía `isBuffer` controlado; llega por express (MCP SDK), override nuevo - baseline-browser-mapping 2.11.21 -> 2.11.23: solo dev, terminación del proceso El lock se toca a mano en esas tres entradas (version, resolved, integrity del registro; qs 6.16.0 añade `es-define-property`, ya presente en 1.0.1). No se re-resuelve con `npm install --package-lock-only`: medido en el primer intento de esta rama, ese comando re-dedupea el árbol y borra `node_modules/balanced-match@4`, que la `minimatch` anidada de typescript-estree necesita, y `lint:boundaries` de core-api cae con `Cannot find module 'balanced-match'` en cuatro suites de CI. `build-and-test` (sdk-cli-release.yml) corría `npm audit --audit-level=high` a pelo: el día que llegue una advisory que ningún override alcance (la forma de GT-657) se queda rojo permanente sin forma de nombrarla. Pasa a correr el mismo gate que sdk-cli-ci.yml, con el mismo umbral. Verificado con `npm ci` desde cero (1257 paquetes): `npm audit` 0/0/0/0, `npm ls` sin invalid/missing, gate ✓, lint:boundaries de core-api limpio y agent-runtime-api (el workspace que toca hono) 89/89. Co-Authored-By: Claude Opus 5 --- .github/workflows/sdk-cli-release.yml | 11 +++++++++-- package-lock.json | 21 ++++++++++++--------- package.json | 4 +++- 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/.github/workflows/sdk-cli-release.yml b/.github/workflows/sdk-cli-release.yml index b64ba2f6..62769176 100644 --- a/.github/workflows/sdk-cli-release.yml +++ b/.github/workflows/sdk-cli-release.yml @@ -257,9 +257,16 @@ jobs: working-directory: ${{ env.CLI_DIR }} run: npm run build + # Same gate as `Security Audit` in sdk-cli-ci.yml, for the same reason (GT-657): + # a raw `npm audit --audit-level=high` cannot express an advisory that no + # override can reach, so the day one lands this job turns permanently red — + # the failure mode GT-622 removed, where a check that is always red trains + # reviewers to discount red. The gate keeps the HIGH threshold and audits the + # whole root lockfile (the CLI's tree is a subset of it); what it adds is that + # such an advisory must be NAMED in .harness/config/npm-audit-exceptions.json + # with the path it arrives by, and it turns red again when the entry goes stale. - name: Security Audit - working-directory: ${{ env.CLI_DIR }} - run: npm audit --audit-level=high + run: node .harness/scripts/ci/63-validate-npm-audit-gate.mjs --verbose - name: Unit Tests (MUST PASS) working-directory: ${{ env.CLI_DIR }} diff --git a/package-lock.json b/package-lock.json index be69ebf7..7a54533e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8474,9 +8474,9 @@ "license": "MIT" }, "node_modules/baseline-browser-mapping": { - "version": "2.11.21", - "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz", - "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==", + "version": "2.11.23", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.23.tgz", + "integrity": "sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==", "dev": true, "license": "Apache-2.0", "bin": { @@ -10968,9 +10968,9 @@ "license": "MIT" }, "node_modules/hono": { - "version": "4.12.34", - "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.34.tgz", - "integrity": "sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==", + "version": "4.13.7", + "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz", + "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==", "license": "MIT", "engines": { "node": ">=16.9.0" @@ -13396,17 +13396,20 @@ "license": "MIT" }, "node_modules/qs": { - "version": "6.15.2", + "version": "6.16.0", "license": "BSD-3-Clause", "dependencies": { - "side-channel": "^1.1.0" + "es-define-property": "^1.0.1", + "side-channel": "^1.1.1" }, "engines": { "node": ">=0.6" }, "funding": { "url": "https://github.com/sponsors/ljharb" - } + }, + "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", + "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==" }, "node_modules/quick-format-unescaped": { "version": "4.0.4", diff --git a/package.json b/package.json index 786f5751..c09efc54 100644 --- a/package.json +++ b/package.json @@ -45,6 +45,8 @@ "ajv": "^6.12.6" }, "ip-address": "10.4.0", - "hono": "4.12.34" + "hono": "4.13.7", + "qs": "6.16.0", + "baseline-browser-mapping": "2.11.23" } } From 37f86b0c88d8ee821bf80c65b8c46c9e197e5cf9 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Mon, 14 Sep 2026 16:41:55 -0500 Subject: [PATCH 2/2] chore(security): fijar cada action por SHA y cada imagen base por digest (Scorecard Pinned-Dependencies) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit La pestaña Security llevaba 94 alertas de OpenSSF Scorecard, 90 de ellas Pinned-Dependencies: 74 `uses:` por tag mutable (67 de GitHub, 7 de terceros), 13 `FROM node:XX-alpine` sin digest y 3 `npm install` sin fijar. Un tag se puede mover; un SHA y un digest no. - 128 referencias `uses:` en 15 workflows + `action.yml` pasan a `owner/repo@ # vX.Y.Z`. El SHA es el del tag exacto al que apunta hoy el tag mayor (`v7` → `v7.0.1`), resuelto con `git ls-remote --tags` y peeled; el comentario es el que dependabot (ecosistema github-actions, ya declarado) usa para seguir subiéndolos. Las que ya estaban por SHA (scorecard, codeql upload-sarif, checkout/setup-node/upload-artifact en un workflow) no se tocan y coinciden con las resueltas. - 13 `FROM node:20-alpine` / `node:22-alpine` en 7 Dockerfiles llevan el digest del manifest list de Docker Hub (multi-arch), resuelto hoy por la API del registro. El guard 56 sigue parseando el `FROM ... AS stage`. - `opa-parity.yml`: `npm install --legacy-peer-deps` → `npm ci --legacy-peer-deps`, como el resto de workflows. - `examples/validate-repo.sh`: `npm install -g @beyondnet/evolith-cli@1.3.2`. Los dos `npm install -g …@${version}` del smoke de sdk-cli-release quedan: son la comprobación del paquete recién publicado y la versión ya es exacta. - `pattern.tools.ts`: import `path` sin uso (única alerta CodeQL abierta). Verificado: `ci-runner fast` ✓, guard 64 ✓, guard 56 ✓ (4 imágenes), guard 58 ✓, los 16 YAML parsean, tsc del mcp-server sin errores nuevos. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci-cd.yml | 56 ++++++++--------- .github/workflows/coverage-impact.yml | 6 +- .github/workflows/docker-images.yml | 10 ++-- .github/workflows/docs-release.yml | 14 ++--- .github/workflows/docs.yml | 10 ++-- .../workflows/enforce-root-cleanliness.yml | 4 +- .../workflows/evolith-validate-dogfood.yml | 10 ++-- .github/workflows/knowledge-intake.yml | 12 ++-- .github/workflows/npm-release.yml | 6 +- .github/workflows/opa-parity.yml | 6 +- .github/workflows/published-canary.yml | 8 +-- .github/workflows/rag-index-sync.yml | 6 +- .github/workflows/reliability.yml | 16 ++--- .github/workflows/sdk-cli-ci.yml | 60 +++++++++---------- .github/workflows/sdk-cli-release.yml | 32 +++++----- action.yml | 2 +- product/infra/docker/bff.Dockerfile | 6 +- product/infra/docker/mcp.Dockerfile | 4 +- src/apps/agent-runtime-api/Dockerfile | 4 +- src/apps/core-api/Dockerfile | 4 +- src/packages/mcp-server/Dockerfile | 4 +- .../mcp-server/src/tools/pattern.tools.ts | 1 - src/sdk/cli/Dockerfile | 4 +- src/sdk/cli/examples/validate-repo.sh | 2 +- 24 files changed, 143 insertions(+), 144 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 562bc8ca..7a0b5235 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -26,12 +26,12 @@ jobs: name: Test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' @@ -171,10 +171,10 @@ jobs: name: Test core-domain runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -231,10 +231,10 @@ jobs: name: Test core runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -250,10 +250,10 @@ jobs: name: Test mcp-server runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -322,10 +322,10 @@ jobs: name: Test core-api runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -359,9 +359,9 @@ jobs: name: Test sdk-client runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -384,9 +384,9 @@ jobs: name: Test contract (SDK wire fidelity) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -425,9 +425,9 @@ jobs: name: Test infra-providers runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -452,9 +452,9 @@ jobs: name: Test agent-runtime runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -472,9 +472,9 @@ jobs: name: Test agent-runtime-api runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -493,9 +493,9 @@ jobs: name: Test contracts runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -526,9 +526,9 @@ jobs: name: Governance guards (GT-578) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' @@ -904,21 +904,21 @@ jobs: dockerfile: ./src/apps/agent-runtime-api/Dockerfile image: evolith-agent-runtime steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Login to GHCR if: env.PUBLISH == 'true' - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build ${{ matrix.service }} (push only from main/tags) - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: ${{ matrix.context }} file: ${{ matrix.dockerfile }} diff --git a/.github/workflows/coverage-impact.yml b/.github/workflows/coverage-impact.yml index bb69b868..8c92a8f5 100644 --- a/.github/workflows/coverage-impact.yml +++ b/.github/workflows/coverage-impact.yml @@ -18,12 +18,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" @@ -68,7 +68,7 @@ jobs: echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT - name: Post coverage comment - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const { pairs_modified, new_need_es, total_en, total_es, paired, coverage } = ${{ toJSON(steps.analyze.outputs) }}; diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml index 65db4d33..257c6ec7 100644 --- a/.github/workflows/docker-images.yml +++ b/.github/workflows/docker-images.yml @@ -37,10 +37,10 @@ jobs: dockerfile: src/packages/mcp-server/Dockerfile steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Log in to GHCR - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -48,7 +48,7 @@ jobs: - name: Compute tags id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: images: ghcr.io/${{ github.repository_owner }}/${{ matrix.name }} # `type=ref,event=tag` publishes the git tag VERBATIM — `v1.1.0`, with @@ -67,10 +67,10 @@ jobs: type=raw,value=latest,enable=${{ github.ref_type == 'tag' }} - name: Set up Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2 with: # Build context is the repository root for all services (the Dockerfiles # COPY repo-relative paths; agent-runtime builds the workspace packages). diff --git a/.github/workflows/docs-release.yml b/.github/workflows/docs-release.yml index af0516da..d4ae3d9a 100644 --- a/.github/workflows/docs-release.yml +++ b/.github/workflows/docs-release.yml @@ -21,7 +21,7 @@ jobs: version: ${{ steps.extract.outputs.version }} branch: ${{ steps.extract.outputs.branch }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-tags: true @@ -60,12 +60,12 @@ jobs: if: needs.release-trigger-check.outputs.version != '' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' @@ -94,7 +94,7 @@ jobs: if: needs.release-trigger-check.outputs.version != '' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 @@ -106,7 +106,7 @@ jobs: git push origin $VERSION - name: Create GitHub Release - uses: actions/create-release@v1 + uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} VERSION: ${{ needs.release-trigger-check.outputs.version }} @@ -136,10 +136,10 @@ jobs: if: github.ref != 'refs/heads/main' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' cache: 'npm' diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9661818c..3dea2f42 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -25,12 +25,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" @@ -56,12 +56,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "20" cache: 'npm' @@ -356,7 +356,7 @@ jobs: node --test .harness/scripts/lib/generated-doc-exclusions.test.mjs - name: Upload coverage report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: github.event_name == 'workflow_dispatch' with: name: coverage-report diff --git a/.github/workflows/enforce-root-cleanliness.yml b/.github/workflows/enforce-root-cleanliness.yml index 6dc8a6c4..81d393f5 100644 --- a/.github/workflows/enforce-root-cleanliness.yml +++ b/.github/workflows/enforce-root-cleanliness.yml @@ -17,10 +17,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' diff --git a/.github/workflows/evolith-validate-dogfood.yml b/.github/workflows/evolith-validate-dogfood.yml index 43d30eb7..2bb71a4d 100644 --- a/.github/workflows/evolith-validate-dogfood.yml +++ b/.github/workflows/evolith-validate-dogfood.yml @@ -60,10 +60,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -83,10 +83,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -172,7 +172,7 @@ jobs: - name: Upload the dogfood compliance report if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: evolith-validate-dogfood-report path: ${{ steps.report.outputs.report-path }} diff --git a/.github/workflows/knowledge-intake.yml b/.github/workflows/knowledge-intake.yml index 9ac6db9e..e3a2b780 100644 --- a/.github/workflows/knowledge-intake.yml +++ b/.github/workflows/knowledge-intake.yml @@ -30,12 +30,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -92,12 +92,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -150,10 +150,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Post PR Comment - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const validateResult = '${{ needs.validate.result }}'; diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml index e26a6cca..fc402042 100644 --- a/.github/workflows/npm-release.yml +++ b/.github/workflows/npm-release.yml @@ -57,10 +57,10 @@ jobs: name: Publish workspaces runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: 'https://registry.npmjs.org' @@ -292,7 +292,7 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Install mcp-publisher run: | diff --git a/.github/workflows/opa-parity.yml b/.github/workflows/opa-parity.yml index b1cca8c7..128e87df 100644 --- a/.github/workflows/opa-parity.yml +++ b/.github/workflows/opa-parity.yml @@ -22,12 +22,12 @@ jobs: name: Native/OPA Semantic Parity (full) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' - name: Install dependencies - run: npm install --legacy-peer-deps + run: npm ci --legacy-peer-deps - name: Compile OPA policies to WASM (pinned opa) run: npm run build:policy - name: Run full Native/OPA parity gate diff --git a/.github/workflows/published-canary.yml b/.github/workflows/published-canary.yml index 2cd375db..d86e6021 100644 --- a/.github/workflows/published-canary.yml +++ b/.github/workflows/published-canary.yml @@ -46,9 +46,9 @@ jobs: # under test: the packages are installed into a throwaway prefix and driven # from a temp directory, which is the whole point — GT-625 shipped an # uninstallable CLI precisely because the workspace symlink hid it. - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' @@ -67,7 +67,7 @@ jobs: # duplicated, so a week of red is one thread and not seven. - name: Open or update the canary issue if: failure() && github.event_name == 'schedule' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const fs = require('fs'); @@ -106,7 +106,7 @@ jobs: # healthy again the thread says so and closes itself. - name: Close the canary issue when the registry is healthy again if: success() && github.event_name == 'schedule' - uses: actions/github-script@v7 + uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 with: script: | const existing = await github.rest.issues.listForRepo({ diff --git a/.github/workflows/rag-index-sync.yml b/.github/workflows/rag-index-sync.yml index 03beb99e..c0f2cf98 100644 --- a/.github/workflows/rag-index-sync.yml +++ b/.github/workflows/rag-index-sync.yml @@ -26,11 +26,11 @@ jobs: name: Delta re-embed changed reference/ chunks runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 2 # HEAD~1..HEAD delta - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '22' @@ -48,7 +48,7 @@ jobs: - name: Upload sync receipt if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: rag-sync-receipt path: rag-sync-receipt.json diff --git a/.github/workflows/reliability.yml b/.github/workflows/reliability.yml index 088cb097..f10e17c0 100644 --- a/.github/workflows/reliability.yml +++ b/.github/workflows/reliability.yml @@ -84,10 +84,10 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 25 steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' @@ -107,7 +107,7 @@ jobs: run: npm run build:policy - name: Install k6 - uses: grafana/setup-k6-action@v1 + uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1 # THROTTLE_MAX_REQUESTS is raised deliberately. core-api throttles every # route at 100 requests / 60 s by default, so ANY real load run against a @@ -173,7 +173,7 @@ jobs: - name: Upload k6 summaries and server log if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: k6-reliability-${{ github.run_id }} path: | @@ -194,15 +194,15 @@ jobs: # and up repeatedly, which is a poor fit for per-PR feedback. if: github.event_name != 'pull_request' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: '20' - name: Install k6 - uses: grafana/setup-k6-action@v1 + uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1 # Engine-only topology: core-api + mcp + redis. The full-stack file is NOT # usable here — it has cross-repo build contexts (the Tracker checked out @@ -362,7 +362,7 @@ jobs: - name: Upload chaos logs if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: chaos-reliability-${{ github.run_id }} path: ${{ runner.temp }}/chaos-*.log diff --git a/.github/workflows/sdk-cli-ci.yml b/.github/workflows/sdk-cli-ci.yml index 1bafd3eb..35c6ba21 100644 --- a/.github/workflows/sdk-cli-ci.yml +++ b/.github/workflows/sdk-cli-ci.yml @@ -59,12 +59,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -96,10 +96,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -149,10 +149,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -192,10 +192,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -222,7 +222,7 @@ jobs: run: npm run test:cov -- --coverageReporters=text-summary --coverageReporters=json-summary - name: Upload Coverage - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: coverage-report path: ${{ env.CLI_DIR }}/coverage/ @@ -245,12 +245,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -294,10 +294,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -361,10 +361,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -413,19 +413,19 @@ jobs: contents: read steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.9 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: javascript-typescript queries: security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.9 + uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.9 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:javascript-typescript" @@ -440,10 +440,10 @@ jobs: contents: read steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run Trivy Vulnerability Scanner - uses: aquasecurity/trivy-action@v0.36.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: 'fs' scan-ref: '.' @@ -452,7 +452,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Upload Trivy SARIF Report - uses: github/codeql-action/upload-sarif@v4.37.9 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 if: always() with: sarif_file: 'trivy-results.sarif' @@ -486,7 +486,7 @@ jobs: # pack and stays compromised, but that is history remediation, a separate # piece of work, not something a pull request can satisfy. - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install gitleaks run: | @@ -503,7 +503,7 @@ jobs: # a leak in the tree should be reported before three minutes of install, # and `node_modules` is not part of what gets scanned either way. - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -528,10 +528,10 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 2 - - uses: actions/setup-node@v7 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} - name: Install dependencies @@ -559,10 +559,10 @@ jobs: continue-on-error: true steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -611,7 +611,7 @@ jobs: # failed with "The artifact name zap_scan is not valid" -- after a clean # scan (FAIL-NEW: 0, WARN-NEW: 1, PASS: 146). v0.12.0 stopped using the # deprecated version; this pins the current release. - uses: zaproxy/action-full-scan@v0.13.0 + uses: zaproxy/action-full-scan@3c58388149901b9a03b7718852c5ba889646c27c # v0.13.0 with: target: 'http://localhost:3001' cmd_options: '-a' @@ -625,7 +625,7 @@ jobs: allow_issue_writing: false - name: Upload ZAP Report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: zap-report diff --git a/.github/workflows/sdk-cli-release.yml b/.github/workflows/sdk-cli-release.yml index 15657dd1..b5f7c87c 100644 --- a/.github/workflows/sdk-cli-release.yml +++ b/.github/workflows/sdk-cli-release.yml @@ -84,12 +84,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} cache: 'npm' @@ -130,7 +130,7 @@ jobs: version: ${{ steps.gate.outputs.version }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Resolve release intent id: gate @@ -232,12 +232,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: 'https://registry.npmjs.org' @@ -349,10 +349,10 @@ jobs: id-token: write steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} registry-url: 'https://registry.npmjs.org' @@ -469,10 +469,10 @@ jobs: ext: '.exe' steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ env.NODE_VERSION }} @@ -532,7 +532,7 @@ jobs: ls -la - name: Upload Binary Artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: binaries-${{ matrix.target }} path: ${{ env.CLI_DIR }}/binaries/evolith-cli-${{ matrix.target }}${{ matrix.ext }} @@ -560,7 +560,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Download Binary - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: binaries-${{ matrix.target }} path: ./binaries @@ -590,7 +590,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download Binary - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: binaries-node20-linux-x64 path: ./binaries @@ -631,10 +631,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download All Binaries - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: pattern: binaries-* path: ./release-assets @@ -651,7 +651,7 @@ jobs: echo "✅ All $count platform binaries present" - name: Upload to Release - uses: softprops/action-gh-release@v3 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: # `tag_name` is a `cli-v*` tag, so this Release is the CLI's own and the # `name`/`body` below overwrite nothing hand-written. On a `v*` tag they @@ -719,7 +719,7 @@ jobs: # not on routine pushes where no release was created (avoids issue spam). - name: Create Issue on Failure if: ${{ github.event_name == 'push' && needs.release-gate.outputs.release_created == 'true' }} - uses: actions/github-script@v9 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | try { diff --git a/action.yml b/action.yml index d50f0e49..e99cd45f 100644 --- a/action.yml +++ b/action.yml @@ -121,7 +121,7 @@ runs: # ------------------------------------------------------------------ - name: Setup Node.js ${{ inputs.node-version }} if: ${{ inputs.cli-command == '' }} - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ inputs.node-version }} diff --git a/product/infra/docker/bff.Dockerfile b/product/infra/docker/bff.Dockerfile index fef5bbb9..c4d5e176 100644 --- a/product/infra/docker/bff.Dockerfile +++ b/product/infra/docker/bff.Dockerfile @@ -4,7 +4,7 @@ # --------------------------------------------------------- # Stage 1: Dependencies and Build -FROM node:22-alpine AS builder +FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder WORKDIR /app # Install dependencies for native modules @@ -17,13 +17,13 @@ COPY . . RUN npm run build # Stage 2: Production Dependencies -FROM node:22-alpine AS prod-deps +FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS prod-deps WORKDIR /app COPY package*.json ./ RUN npm ci --only=production && npm cache clean --force # Stage 3: Runtime -FROM node:22-alpine AS runtime +FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runtime WORKDIR /app # Standard Evolith security rules: do not run as root diff --git a/product/infra/docker/mcp.Dockerfile b/product/infra/docker/mcp.Dockerfile index 531690ca..a5872d97 100644 --- a/product/infra/docker/mcp.Dockerfile +++ b/product/infra/docker/mcp.Dockerfile @@ -3,7 +3,7 @@ # MCP Server Dockerfile Template (HTTP/SSE Mode) # --------------------------------------------------------- -FROM node:22-alpine AS builder +FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder WORKDIR /app COPY package*.json ./ @@ -12,7 +12,7 @@ RUN npm ci COPY . . RUN npm run build -FROM node:22-alpine AS runtime +FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runtime WORKDIR /app RUN addgroup -g 1001 -S evolith && \ diff --git a/src/apps/agent-runtime-api/Dockerfile b/src/apps/agent-runtime-api/Dockerfile index a05e158b..49a25b18 100644 --- a/src/apps/agent-runtime-api/Dockerfile +++ b/src/apps/agent-runtime-api/Dockerfile @@ -8,7 +8,7 @@ # Dockerfile location = src/apps/agent-runtime-api/Dockerfile # Build context / base directory = / (repository root) # ────────────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS builder +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder WORKDIR /repo @@ -95,7 +95,7 @@ RUN test -f src/apps/agent-runtime-api/dist/main.js || { \ RUN npm prune --omit=dev --legacy-peer-deps # ── Runner ────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS runner +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner LABEL org.opencontainers.image.title="Evolith Agent Runtime API" LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_arch32" diff --git a/src/apps/core-api/Dockerfile b/src/apps/core-api/Dockerfile index 7b65d60a..180f2415 100644 --- a/src/apps/core-api/Dockerfile +++ b/src/apps/core-api/Dockerfile @@ -8,7 +8,7 @@ # package. This image builds the workspace packages from source instead. # Coolify: Dockerfile = src/apps/core-api/Dockerfile, base directory = / # ────────────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS builder +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder WORKDIR /repo @@ -63,7 +63,7 @@ RUN test -f src/apps/core-api/dist/main.js || { \ RUN npm prune --omit=dev --legacy-peer-deps # ── Runner ────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS runner +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner LABEL org.opencontainers.image.title="Evolith Core API" LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_arch32" diff --git a/src/packages/mcp-server/Dockerfile b/src/packages/mcp-server/Dockerfile index d9649c03..2e3fbed9 100644 --- a/src/packages/mcp-server/Dockerfile +++ b/src/packages/mcp-server/Dockerfile @@ -7,7 +7,7 @@ # (@beyondnet/evolith-core-domain, @beyondnet/evolith-infra-providers, @beyondnet/evolith-core) from source. # Coolify: Dockerfile = src/packages/mcp-server/Dockerfile, base directory = / # ────────────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS builder +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder WORKDIR /repo @@ -48,7 +48,7 @@ RUN test -f src/packages/mcp-server/dist/main.js || { \ RUN npm prune --omit=dev --legacy-peer-deps # ── Runner ────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS runner +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner LABEL org.opencontainers.image.title="Evolith MCP Server" LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_arch32" diff --git a/src/packages/mcp-server/src/tools/pattern.tools.ts b/src/packages/mcp-server/src/tools/pattern.tools.ts index 7e0aba07..1d52af28 100644 --- a/src/packages/mcp-server/src/tools/pattern.tools.ts +++ b/src/packages/mcp-server/src/tools/pattern.tools.ts @@ -1,4 +1,3 @@ -import * as path from 'node:path'; import { resolveCorePath } from '../mcp/core-path'; import type { IFileSystem, ILogger } from '@beyondnet/evolith-core'; import { PatternCatalogService } from '@beyondnet/evolith-core'; diff --git a/src/sdk/cli/Dockerfile b/src/sdk/cli/Dockerfile index e9e8976a..be75d9d3 100644 --- a/src/sdk/cli/Dockerfile +++ b/src/sdk/cli/Dockerfile @@ -19,7 +19,7 @@ # This image is the CLI: a governance tool you exec against a mounted # satellite workspace, not a long-running server. # ────────────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS builder +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder WORKDIR /repo @@ -51,7 +51,7 @@ RUN npx tsc -b tsconfig.json && \ RUN npm prune --omit=dev --legacy-peer-deps # ── Runner ────────────────────────────────────────────────────────────────── -FROM node:20-alpine AS runner +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner LABEL org.opencontainers.image.title="Evolith CLI" LABEL org.opencontainers.image.description="Evolith CLI — governance, standards validation, and AI agent integration for satellite repositories" diff --git a/src/sdk/cli/examples/validate-repo.sh b/src/sdk/cli/examples/validate-repo.sh index c3b29cbc..c938bd7c 100644 --- a/src/sdk/cli/examples/validate-repo.sh +++ b/src/sdk/cli/examples/validate-repo.sh @@ -20,7 +20,7 @@ echo "==============================================" # Check if evolith CLI is available if ! command -v evolith &> /dev/null; then echo "Installing Evolith CLI..." - npm install -g @beyondnet/evolith-cli + npm install -g @beyondnet/evolith-cli@1.3.2 fi # Run validation