Retain all applicable checks behind one result and use native CircleCI reporting.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Overlay mutable external SNAPSHOT dependencies as well as locally installed reactor outputs so downstream jobs do not read older snapshots from the immutable cache.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Give the differently parameterized production build a distinct name so CircleCI retains build-and-test for pull requests.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Keep restore and save keys stable across release version rewrites, avoid inherited cross-version caches, skip unused OWASP setup, upload test results once and pack the orb once before gated publication.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Force fresh base-image metadata and package upgrades for supplemental images while retaining enforced vulnerability scans before publication.
Co-Authored-By: Codex <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
- run_trivy.sh: `trivy fs` ran without --exit-code, so it always exited 0
and security-scan passed with HIGH/CRITICAL findings in the report. Add
--exit-code 1 and print the findings table on failure.
- Semgrep 1.61.1 cannot parse the current `auto` ruleset, so sast-scan ran
zero rules on zero files and passed. Move the executor to
semgrep/semgrep:1.181.0, and fail the job when the report shows no files
scanned or a rule configuration error (even in warn-only mode). Print a
findings summary in the job output.
- tests/test_scan_gates.sh covers both gates with tool stubs.
Consumers pick this up when they bump their pinned orb version; repos with
existing HIGH/CRITICAL or Semgrep findings will need to triage them then.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CircleCI renders the boolean push parameter as 1/0 in the step
environment, but build_push_supplemental.sh only pushed when
PUSH_IMAGES was the string "true". Since 0.3.5 every release build
built and scanned supplemental images and never pushed them, so
deployments referencing them hit ImagePullBackOff (kof22 0.1.75).
PUSH_IMAGES now accepts true/1/yes/on and false/0/no/off/empty; unset
still means push, and an unrecognised value fails before any build.
Tests cover release-mode pushes (1, true, TRUE) of every supplemental
image, PR-mode non-pushes (0, false, empty), and the invalid value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
New munitor/docker_scan job (image-scan) in the pr-checks workflow of
java-webapp, gradle-webapp, node-api and node-webapp: builds the app
image and every supplemental image, runs the same Trivy 0.69.3
HIGH/CRITICAL --exit-code 1 scan as the release pipeline (same
.trivyignore), stores the JSON results, and never pushes.
build_push_supplemental gains push (default true, unchanged behavior).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
update_cd_repo creates the CD commit through the GraphQL
createCommitOnBranch mutation so GitHub signs it, letting the GitOps
repository require signed commits without a bypass actor. Concurrent
bumps retry against the refreshed head.
CI pins circleci/orb-tools to 12.5.0 and adds a test job running the
script, template and BATS suites. Feature branches publish only the
immutable dev:<sha> tag; develop keeps dev:snapshot (#26). The
generator accepts the documented org key (#27). Adds .editorconfig.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
james.maes
