Skip to content

v1.7.2 — Pagination + processing-banner trap + CI workflow fix

Choose a tag to compare

View all tags
@clem-field clem-field released this 24 May 23:22
v1.7.2
5c8bf13

v1.7.2 — Pagination + processing-banner trap + CI workflow fix

Patch release covering three prod-surfaced bugs and a critical CI fix.
Re-tagged after the original v1.7.2 tag failed to build because of a
GitHub Actions validator issue — same content + the workflow fix that
enables the image to actually publish this time (see PR #553).

Fixes

Pagination ignores ?items / ?per_page (#549, PR #552)
Api::V1::BaseController#paginate accepted an items: Ruby kwarg
but never read it from request params, so every paginated index
silently returned the per-endpoint default (typically 25). Fix wires
params[:items] / params[:per_page] through with a clamp at
MAX_PAGINATION_LIMIT = 200 to block ?items=999999 DoS attempts.
Affects every controller using the shared helper: cdef, ssp, sar,
sap, poam, profile, control_catalog, control_mapping, users.

Processing-banner meta-refresh trap (#548 Tier 1, PR #552)
Document show pages emitted <meta http-equiv="refresh" content="3">
for any pending/processing record with no timeout. Records whose
parsing job never ran (API stub creations, dead Sidekiq jobs) trapped
the browser tab in a 3-second redirect loop the operator couldn't
navigate away from.

Tier 1 fix: stop emitting the meta-refresh when the document is
older than SparcConfig.processing_stuck_minutes (default 5,
override via SPARC_PROCESSING_STUCK_MINUTES). Render a "Processing
Stuck" message + Back button instead. Tier 2 (API create defaults
to status=complete) and Tier 3 (background sweeper) tracked in #548.

build-sign-publish workflow validator fixes (#547 + #553)
Two-part fix for the GitHub Actions workflow validator rejecting
build-sign-publish.yml after the v1.7.1 #543 vars→secrets rotation:

- #547: declared the new `AWS_ROLE_ARN` / `AWS_REGION` /
  `ECR_REGISTRY` references in `on.workflow_call.secrets` so
  reusable-workflow callers can supply them.
- #553: hoisted `secrets.ECR_REGISTRY != ''` out of step-level
  `if:` conditionals (where the `secrets` context is forbidden
  despite the docs) into job-level `env: HAS_ECR`. Step `if:`
  now references `env.HAS_ECR == 'true'`, mirroring the existing
  `HAS_DISPATCH_TOKEN` pattern in security.yml.

Without #553 the v1.7.2 tag silently failed to fire the workflow,
so the v1.7.2 container image never published on the first tag
attempt. This re-tag corrects that.

Deployment

New environment variable for sparc-iac to wire in (tracked at
risk-sentinel/sparc-iac#289):

SPARC_PROCESSING_STUCK_MINUTES=5 # baseline; bump for slower envs

Container image

risksentinel/sparc:1.7.2

Compatibility

No schema changes. No API contract changes (pagination expanded; old
default behavior preserved when no param is sent). Drop-in upgrade
from v1.7.1.

Assets 2
Loading