feat(security): every image gets a measured budget; VEX the go-git high #125

Merged

ryangr0 merged 1 commit from feat/cve-budgets-measured into main

2026-08-11 04:21:10 +00:00

ryangr0 commented

2026-08-09 15:41:46 +00:00

Owner

Phase 2. From run 337 — the first measurement of the estate with every base digest-pinned, so each budget describes an exact artifact. All 18 images now carry a budget set at the observed count:

image	budget (crit/high)	image	budget
techdocs-builder	131/475	semantic-release-rust	38/76
techdocs-runner	131/503	semantic-release ×2	36/73, 36/72
mkdocs-runner	131/501	helm-deploy	21/104
rust-releaser	67/256	ci-runner	15/113
playwright-runner	62/141	vikunja-mcp	8/66
tauri-ci-runner	59/401	node-ci-runner	1/11
php-ci-runner	50/118	cve-gate	0/0 enforce
agent-runner	43/107	act-runner	40/123
rust-ci-runner	40/78	rust-releaser ↑

Two deliberate decisions:

Warn mode, promotion after two stable releases — the header's old rule said flip-to-enforce on first observation; combined with daily scanner-DB drift that converts a new upstream CVE into a blocked release the next morning. The roadmap's two-release rule now governs, and the header says so.
cve-gate stays enforce 0/0 — the overnight high gets a VEX statement, not a budget raise. GHSA-hc8v-wwc9-vgxm (CVE-2026-71556): go-git v5.19.1 worktree-symlink writes, vendored in the grype binary. Measured before authoring (the #100 lesson — grype reports the GHSA, alias carried). The gate only invokes grype against registry: sources — no clone, no worktree — so vulnerable_code_not_in_execute_path, with a definite expiry: the fix exists (5.19.2); the statement clears when DHI ships grype rebuilt against it. Without this statement the next cve-gate release fails its own gate.

No builds triggered (neither file is under ops/docker/**); budgets bind at each image's next release.

Generated with Claude Code

**Phase 2.** From run 337 — the first measurement of the estate with every base digest-pinned, so each budget describes an exact artifact. **All 18 images now carry a budget** set at the observed count: | image | budget (crit/high) | | image | budget | |---|---|---|---|---| | techdocs-builder | 131/475 | | semantic-release-rust | 38/76 | | techdocs-runner | 131/503 | | semantic-release ×2 | 36/73, 36/72 | | mkdocs-runner | 131/501 | | helm-deploy | 21/104 | | rust-releaser | 67/256 | | ci-runner | 15/113 | | playwright-runner | 62/141 | | vikunja-mcp | 8/66 | | tauri-ci-runner | 59/401 | | node-ci-runner | 1/11 | | php-ci-runner | 50/118 | | **cve-gate** | **0/0 enforce** | | agent-runner | 43/107 | | act-runner | 40/123 | | rust-ci-runner | 40/78 | | rust-releaser ↑ | | Two deliberate decisions: 1. **Warn mode, promotion after two stable releases** — the header's old rule said flip-to-enforce on first observation; combined with daily scanner-DB drift that converts a new upstream CVE into a blocked release the next morning. The roadmap's two-release rule now governs, and the header says so. 2. **cve-gate stays enforce 0/0 — the overnight high gets a VEX statement, not a budget raise.** GHSA-hc8v-wwc9-vgxm (CVE-2026-71556): go-git v5.19.1 worktree-symlink writes, vendored in the grype binary. Measured before authoring (the #100 lesson — grype reports the GHSA, alias carried). The gate only invokes grype against `registry:` sources — no clone, no worktree — so `vulnerable_code_not_in_execute_path`, with a definite expiry: the fix exists (5.19.2); the statement clears when DHI ships grype rebuilt against it. Without this statement the next cve-gate release fails its own gate. No builds triggered (neither file is under `ops/docker/**`); budgets bind at each image's next release. Generated with [Claude Code](https://claude.com/claude-code)

ryangr0 added 1 commit

2026-08-09 15:41:46 +00:00

feat(security): every image gets a measured budget; VEX the go-git high 515f76030d

Phase 2 of the hardening plan, from run 337 — the first measurement of the
estate with every base digest-pinned, so each budget describes an exact
artifact. All 18 images now carry a budget set AT the observed count, warn
mode; the header's promotion rule changes from flip-on-first-observation to
the roadmap's hold-across-two-releases, because a single observation plus
normal scanner-DB drift equals a blocked release the next morning.

ci-runner and agent-runner get their July numbers replaced with current
observations and honest notes about why they moved. playwright-runner's 0/0
placeholder becomes its real ceiling (62/141).

cve-gate stays enforce 0/0 — and grew a high overnight: GHSA-hc8v-wwc9-vgxm
(CVE-2026-71556), go-git v5.19.1 worktree symlink writes, vendored in the
grype binary. Measured before authoring (the #100 lesson): grype reports the
GHSA with the CVE as alias, so the statement carries both. The gate only
ever invokes grype against registry: sources — no clone, no worktree, no git
operations — so vulnerable_code_not_in_execute_path, with a definite expiry:
a fix exists (5.19.2), it clears when DHI ships grype rebuilt against it.

Neither file is under ops/docker/**, so this triggers no builds; the budgets
bind at each image's next release.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ryangr0 merged commit 7f2cc41710 into main

2026-08-11 04:21:10 +00:00

ryangr0 referenced this pull request from a commit

2026-08-11 04:21:10 +00:00

Merge pull request 'feat(security): every image gets a measured budget; VEX the go-git high' (#125) from feat/cve-budgets-measured into main