mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(ci): web pipeline Docker/Trivy step failure on main (pipeline #518) #430

New Issue
Closed
opened 2026-02-21 20:27:22 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-02-21 20:27:22 +00:00
Owner
Copy Link

Context

Pipeline #518 on main (merge commit c23ebca from PR #429) has api and orchestrator passing but web failing.

What was fixed in PR #429

  • Added pnpm overrides for minimatch (>=10.2.1) and tar (>=7.5.8) to resolve audit failures
  • Added localStorage mock to web vitest setup to fix ThemeProvider test failures

Current state

All code quality gates pass on main: lint, typecheck, tests (89/89 pass), and production build all succeed.

The failure is in the Docker build, Trivy scan, or package linking step that only runs on main/develop branches.

Possible causes

  1. Trivy found a new HIGH/CRITICAL vulnerability not in .trivyignore
  2. Next.js bundled tar (at next/dist/compiled/tar/) has a new CVE beyond the 3 already ignored
  3. Kaniko Docker build infrastructure issue
  4. pnpm version mismatch between CI (node:24-alpine corepack) and Dockerfile (pnpm@10.27.0)

Investigation needed

  • Check Woodpecker CI logs for pipeline 518 step 3 (web)
  • Identify which sub-step failed (docker-build, trivy, or link-packages)
  • Apply appropriate fix

Related

  • Pipeline #516: original failures (api, orchestrator, web) - fixed by PR #429
  • Pipeline #517: PR branch CI - all 3 steps passed
  • Pipeline #518: main after merge - api+orchestrator pass, web fails
## Context Pipeline #518 on main (merge commit c23ebca from PR #429) has api and orchestrator passing but web failing. ## What was fixed in PR #429 - Added pnpm overrides for minimatch (>=10.2.1) and tar (>=7.5.8) to resolve audit failures - Added localStorage mock to web vitest setup to fix ThemeProvider test failures ## Current state All code quality gates pass on main: lint, typecheck, tests (89/89 pass), and production build all succeed. The failure is in the Docker build, Trivy scan, or package linking step that only runs on main/develop branches. ## Possible causes 1. Trivy found a new HIGH/CRITICAL vulnerability not in .trivyignore 2. Next.js bundled tar (at next/dist/compiled/tar/) has a new CVE beyond the 3 already ignored 3. Kaniko Docker build infrastructure issue 4. pnpm version mismatch between CI (node:24-alpine corepack) and Dockerfile (pnpm@10.27.0) ## Investigation needed - Check Woodpecker CI logs for pipeline 518 step 3 (web) - Identify which sub-step failed (docker-build, trivy, or link-packages) - Apply appropriate fix ## Related - Pipeline #516: original failures (api, orchestrator, web) - fixed by PR #429 - Pipeline #517: PR branch CI - all 3 steps passed - Pipeline #518: main after merge - api+orchestrator pass, web fails
jason.woltje added the devops label 2026-02-21 20:27:22 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label devops
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#430
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?