mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
460049bf67
Two questions the existing scans cannot answer. The dependency audit runs with --prod, which is the right scope for a blocking gate but leaves a gap: a dev dependency can still ship. pdfjs-dist is the case that made this concrete. It sits in devDependencies, and rasterize-pdf.ts imports it at runtime, so standalone output tracing copies it into the production image where the prod-scoped audit has never looked. Trivy reads 627 packages out of pnpm-lock.yaml without --include-dev-deps and 1455 with it; pdfjs-dist is only in the second set. Trivy's help text lists the flag as npm/yarn/gradle only, but it works on the pnpm lockfile too, which is worth knowing before someone deletes it as a no-op. The container scan builds the image from the current main. Nobody runs that image. What self-hosters pull is the one built from the last release tag, and an advisory published after the tag lands against an image nothing is about to rebuild. So the second job scans ghcr.io/mbombeck/ healthlog:latest instead of a local build. Schedule only, no push or pull_request trigger, because the change- triggered half is already covered and would just run twice. The lockfile job reports into code scanning without failing: widening to dev dependencies surfaces transitive tool advisories by the dozen, and a red badge from day one gets muted inside a week. The image job fails on CRITICAL, after its own report has been uploaded by a separate step.