Merge pull request #43 from KofTwentyTwo/release/0.3.8

chore(release): publish Munitor 0.3.8

README.md

@@ -6,7 +6,7 @@ Latin: *munitor* (fortifier, protector) -- KofTwentyTwo's unified CircleCI orb f
 | --- | --- |
 | **Tier** | Internal until classified -- listed under *Awaiting classification* in the KofTwentyTwo standards [MAINTAINERS.md](https://github.com/KofTwentyTwo/standards/blob/main/MAINTAINERS.md); Product-tier requirements are being adopted |
 | **Standards** | Targets [KofTwentyTwo standards](https://github.com/KofTwentyTwo/standards) 1.0.0 |
-| **Orb** | [`kof22/munitor`](https://circleci.com/developer/orbs/orb/kof22/munitor), latest stable `0.3.7` |
+| **Orb** | [`kof22/munitor`](https://circleci.com/developer/orbs/orb/kof22/munitor), latest stable `0.3.8` |
 | **Security** | [SECURITY.md](SECURITY.md) |
 | **Contributing** | [CONTRIBUTING.md](CONTRIBUTING.md) |
 
@@ -70,16 +70,16 @@ Munitor validates branch names and will fail on non-conforming names.
 
 Munitor is a public CircleCI orb: any CircleCI organization can use it without forking. This checklist covers what a new consumer needs, for example a Java/Maven web service. A QQQ application should also read the [QQQ adoption checklist](https://github.com/QRun-IO/qqq/blob/develop/docs/migration/adoption-checklist.adoc) (section 7 covers release tooling).
 
-**Version.** Use `kof22/munitor@0.3.7` (or `@0.3` to float on the 0.3 line) in `.circleci/config.yml`, and the same value as `orb_version` in `.munitor.yml`. Keep the setup orb and the generated pipeline on the same line.
+**Version.** Use `kof22/munitor@0.3.8` (or `@0.3` to float on the 0.3 line) in `.circleci/config.yml`, and the same value as `orb_version` in `.munitor.yml`. Keep the setup orb and the generated pipeline on the same line.
 
 ### 1. Repository files
 
-- `.circleci/config.yml`: the setup config from [Quick Start](#quick-start), pinned to `kof22/munitor@0.3.7`.
+- `.circleci/config.yml`: the setup config from [Quick Start](#quick-start), pinned to `kof22/munitor@0.3.8`.
 - `.munitor.yml`: pick a [pipeline type](#pipeline-types). A Java service is `java-webapp`. KofTwentyTwo's Website-Backend is a working example; a generalized version:
 
 ```yaml
 pipeline: java-webapp
-orb_version: "0.3.7"
+orb_version: "0.3.8"
 image_name: my-service
 java_version: "21"
 docker:

docs/SESSION-STATE.md

@@ -1,3 +1,7 @@
+## Supplemental runtime freshness (2026-10-19)
+
+Backend PR311 image scan6307 failed because db-backup reused a cached apk-upgrade layer (libexpat2.8.5-r0, fixed2.9.0-r0). Supplemental builds now use --pull --no-cache in both PR scan-only and release publishing paths. Trivy and immutable-tag guards remain unchanged. Targeted tests cover both Dockerfile forms, fresh-build flags, scan-before-push ordering and scan failure propagation. Validation pending; no release or consumer adoption yet.
+
 # Munitor session state
 
 ## JVM runtime package freshness (2026-10-19)
@@ -101,3 +105,9 @@ Runtime freshness validation: coordinating agent completed make all (lint, pack,
 
 ## Release 0.3.7 preparation (2026-10-19)
 Includes merged PR38 (filesystem Trivy findings fail CI; current Semgrep image and zero-scan/configuration failures) and PR39 (pull fresh runtime bases and bypass cached JVM package-upgrade layers). Both feature PRs passed all CircleCI gates; PR39 also passed full local make all and seven BATS tests. Publish the stable orb only from a signed v0.3.7 tag on the reviewed main merge. Website-Backend must update both orb pins and pass real image/SAST scans before rollout. No vulnerability waiver or immutable-tag overwrite is part of this release.
+
+Validation completed: focused scan tests12/12, full make all (lint, packed orb validation, script/template tests), and7BATS passed under WSL/Nix on2026-10-19. Real backend supplemental image scans remain required after stable release adoption.
+
+## Release candidate 0.3.8 (2026-10-19)
+
+Promotes PR42 supplemental build freshness fix (develop11d5704) to main. Full local make all and seven BATS passed; all PR42 CI checks passed. Release metadata changes only; source/tests match the verified feature. Stable publication still requires the approved main merge and signed v0.3.8 tag. Backend adoption and real supplemental scans remain pending.

docs/TODO.md

@@ -2,6 +2,8 @@
 
 ## Pending
 
+- [ ] Validate and release supplemental-image freshness fix, then adopt it in backend PR311 and verify all supplemental Trivy scans.
+
 - [ ] Release JVM runtime cache fix and adopt the stable orb in Website-Backend; verify fresh image Trivy before release.
 
 - [ ] Run PR image-scan script/template/BATS tests on Linux and verify a consumer PR with Docker/Trivy before publishing.

src/scripts/build_push_supplemental.sh

@@ -83,7 +83,8 @@ for i in $(seq 0 $((COUNT - 1))); do
 
   # Build
   echo "Building ${FULL_TAG} ..."
-  BUILD_ARGS=(-f "${DOCKERFILE}" -t "${FULL_TAG}")
+  # Refresh base images and rerun package upgrades in supplemental Dockerfiles.
+  BUILD_ARGS=(--pull --no-cache -f "${DOCKERFILE}" -t "${FULL_TAG}")
   if [[ -n "${CIRCLE_SHA1:-}" ]]; then
     BUILD_ARGS+=(--label "org.opencontainers.image.revision=${CIRCLE_SHA1}")
   fi

tests/test_docker_scan.sh

@@ -57,11 +57,11 @@ else
   fail
 fi
 
-echo -n "  TEST: push=false builds and scans every supplemental without publishing... "
+echo -n "  TEST: push=false refreshes both Dockerfile forms and scans without publishing... "
 : > "${CALL_LOG}"
 echo 'export DOCKER_ENV_TAG=develop' >> "${BASH_ENV}"
 if PUSH_IMAGES=false bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
-  [[ $(grep -c '^docker build ' "${CALL_LOG}") == 2 ]] &&
+  [[ $(grep -c '^docker build --pull --no-cache -f ' "${CALL_LOG}") == 2 ]] &&
   [[ $(grep -c '^trivy image .*--severity HIGH,CRITICAL --exit-code 1 ' "${CALL_LOG}") == 2 ]] &&
   ! grep -Eq '^docker (push|login|tag|buildx) ' "${CALL_LOG}" &&
   [[ -s "${WORK}/migrations.json" && -s "${WORK}/worker.json" ]]; then
@@ -70,11 +70,16 @@ else
   fail
 fi
 
-echo -n "  TEST: default push still publishes version and environment tags... "
+echo -n "  TEST: default push refreshes both Dockerfile forms and scans before publishing tags... "
 : > "${CALL_LOG}"
 unset PUSH_IMAGES
 if bash "${SRC_SCRIPTS}/build_push_supplemental.sh" > "${WORK}/supplemental.log" &&
-  [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]]; then
+  [[ $(grep -c '^docker build --pull --no-cache -f ' "${CALL_LOG}") == 2 ]] &&
+  [[ $(grep -c '^docker push ' "${CALL_LOG}") == 4 ]] &&
+  awk '
+    /^trivy image / { image=$NF; sub(/:[^:]+$/, "", image); scanned[image]=1 }
+    /^docker push / { image=$NF; sub(/:[^:]+$/, "", image); if (!scanned[image]) exit 1 }
+  ' "${CALL_LOG}"; then
   pass
 else
   fail