Jason Woltje 7fb70210a4 fix(ci): move spec removal to builder stage + suppress tar CVEs ...

Two Trivy fixes:

1. Dockerfile: moved spec/test file deletion from production RUN step
   to builder stage. The previous approach (COPY then RUN rm) left files
   in the COPY layer — Trivy scans all layers, not just the final FS.
   Now spec files are deleted in builder BEFORE COPY to production.

2. .trivyignore: added 3 tar CVEs (CVE-2026-23745/23950/24842) with
   documented rationale. tar@7.5.2 is bundled inside npm which ships
   with node:20-alpine. Not upgradeable — not our dependency. npm is
   already removed from all production images.

Verified: local Trivy scan passes (exit code 0, 0 findings)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-12 19:19:27 -06:00

..

api

fix(ci): mitigate 11 upstream CVEs at source instead of suppressing

2026-02-12 17:10:44 -06:00

coordinator

fix(#363,#364,#365): fix pipeline #362 failures — gosu setuid, trivy CVEs, test exclusions

2026-02-12 16:23:52 -06:00

orchestrator

fix(ci): move spec removal to builder stage + suppress tar CVEs

2026-02-12 19:19:27 -06:00

web

fix(ci): fix pipeline #366 — web @mosaic/ui build, Dockerfile find bug, event handler types

2026-02-12 17:50:41 -06:00