CI security scanning #14

New issue

Closed

opened 2026-06-12 20:27:44 +00:00 by james · 0 comments

james commented

2026-06-12 20:27:44 +00:00

Owner

Scope

Dependency scanning: npm audit at minimum, plus OSV-Scanner for broader coverage.
Container image scan on the built service image (Trivy or equivalent).
Fail the PR check on findings at or above a configured severity. Start with high.

Acceptance criteria

A deliberately vulnerable dependency in a throwaway branch trips the check.
Findings are surfaced in the PR check output, not buried in raw logs.
The severity threshold is documented and configurable in one place.

Part of epic #2. Depends on #13.

## Scope - Dependency scanning: `npm audit` at minimum, plus OSV-Scanner for broader coverage. - Container image scan on the built service image (Trivy or equivalent). - Fail the PR check on findings at or above a configured severity. Start with `high`. ## Acceptance criteria - [ ] A deliberately vulnerable dependency in a throwaway branch trips the check. - [ ] Findings are surfaced in the PR check output, not buried in raw logs. - [ ] The severity threshold is documented and configurable in one place. Part of epic #2. Depends on #13.

james added the

area:ci

label

2026-06-12 20:31:54 +00:00

james referenced this issue from a commit

2026-06-12 21:00:03 +00:00

Scaffold Next.js + TypeScript service (#7)

james referenced this issue

2026-06-12 21:02:38 +00:00

Scaffold Next.js + TypeScript service (#7) #32

james referenced this issue

2026-06-12 21:55:28 +00:00