chore(audit): execute 2026-06-03 audit — digest pins, healthchecks, explicit concurrency, prod log hygiene#116
Merged
Merged
Conversation
Adds a dockerfile-base-image-sha-pin lint-meta rule to both apps so every Dockerfile FROM must carry an @sha256 digest (stage aliases and scratch exempt), surfaces the unpinned ui builder stage through the rule, then pins it to the same oven/bun digest used by apps/api. Audit: F001
Exports checkEnginePinParity from the lint-meta cli like its sibling checks and adds a four-scenario suite (missing engines.bun, Dockerfile drift, CI workflow drift, aligned) so the parity guardrail is itself guarded. Audit: F003
The prod ui service was the only long-running prod service without a healthcheck (dev/smoke profiles already probe /healthz, which prod nginx.conf serves). Traefik gains an internal --ping healthcheck too. A new validate-compose CI step asserts every long-running prod-profile service in the base compose file defines a healthcheck; one-shot jobs (restart "no") are exempt. Audit: F004
The prod path of emit() printed every masked log entry to the browser console, exposing the app's event stream to anyone with devtools open. Production is now Sentry-breadcrumb-only; a prod-mode test (env.DEV mocked false) locks in breadcrumb capture, PII masking, and console silence. Audit: F002
New github-actions-concurrency-explicit lint-meta rule (both apps) requires an explicit cancel-in-progress on every workflow concurrency block. Surfaced four implicit defaults: apps-api-release now states false (matching apps-ui-release — never cancel an in-flight image push); the acl-drift, openapi-drift, and validate-compose validation workflows opt into true since superseded runs are worthless. Audit: F005
Six scripts invoked node directly while the repo standard (and packageManager pin) is bun; bun executes the same .mjs files natively. Also commits the regenerated lint-meta catalog picking up the new dockerfile-base-image-sha-pin and github-actions-concurrency-explicit rules. Audit: F006
The auth fixture pinned configuredAt to 2026-01-01, drifting ever further into the past; if consent re-prompt logic ever lands, every e2e run would silently exercise the stale-consent path. The canonical now() helper keeps the fixture a fresh dismissal. Audit: F007
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
audit-monoreporun (guardrail-first: every class-of-defect fix ships with the lint rule that now prevents it).Dockerfile.prodbuilder stage pinned by sha256 digest + newdockerfile-base-image-sha-pinlint-meta rule in both apps (F001); prod ui logger no longer prints structured log entries to the browser console — Sentry-breadcrumb-only, locked by a prod-mode test (F002).ui(nginx/healthz) andtraefik(--ping) plus a validate-compose CI step requiring healthchecks on all long-running prod services (F004); newgithub-actions-concurrency-explicitlint-meta rule — releases statecancel-in-progress: false, validation/drift workflows opt intotrue(F005); engine-pin-parity rule now directly unit-tested (F003); docs scripts route throughbun run(F006); e2e consent fixture timestamps via canonicalnow()(F007).New guardrails immediately caught instances beyond the audit's: traefik's missing healthcheck and three more workflows with implicit concurrency defaults.
Test plan
cd apps/api && bun run check+bun test tests/lint-meta(57 pass)cd apps/ui && bun run check+ lint-meta vitest suite (46 pass) + logger tests (11 pass)cd apps/docs && bun run build:ci(incl. fragment check)docker compose --profile prod config+ yamllint (CI config) on compose changesConventions
any, no blindas, no!.env.example(+ SECURITY.md when relevant) — n/a, none addedScreenshots
n/a — no visual UI changes (logger + e2e fixture only).