Workflow adjustment

Author: BlkLeg Shawnji

.github/workflows/block-tests.yml

@@ -1,5 +1,7 @@
 name: Block Tests in Prod Paths
 on: [pull_request]
+permissions:
+  contents: read
 jobs:
   check-prod:
     runs-on: ubuntu-latest

.github/workflows/ci.yml.retired

@@ -101,7 +101,7 @@ jobs:
           output: trivy-results.sarif
 
       - name: Upload Trivy scan results
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: trivy-results.sarif

.github/workflows/docker-build.yml

@@ -5,11 +5,6 @@ on:
     tags:
       - 'v*'
   workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Image tag to push (e.g. v0.1.5)'
-        required: false
-        default: 'dev'
 
 permissions:
   contents: read
@@ -42,7 +37,7 @@ jobs:
           if [ "${{ github.event_name }}" = "push" ]; then
             RAW_TAG="${{ github.ref_name }}"
           else
-            RAW_TAG="${{ github.event.inputs.tag }}"
+            RAW_TAG="dev"
           fi
           SAFE_TAG=$(printf '%s' "$RAW_TAG" | tr -cd '[:alnum:]_.-')
           if [ -z "$SAFE_TAG" ]; then

.github/workflows/preflight.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.12'
 
       - name: Set up Node
         uses: actions/setup-node@v4

.github/workflows/security.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           args: --all-projects --sarif-file-output=snyk-results.sarif
       - name: Upload Snyk results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: snyk-results.sarif
@@ -62,7 +62,7 @@ jobs:
           output: trivy-fs-results.sarif
           severity: 'CRITICAL,HIGH'
       - name: Upload Trivy filesystem results
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: trivy-fs-results.sarif
@@ -80,7 +80,7 @@ jobs:
           format: sarif
           output: trivy-config-results.sarif
       - name: Upload Trivy config results
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: trivy-config-results.sarif
@@ -99,7 +99,7 @@ jobs:
       - name: Run Semgrep
         run: semgrep scan --config p/default --sarif --output semgrep.sarif apps/backend/src/ apps/frontend/src/ docker/ || true
       - name: Upload Semgrep results
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always() && hashFiles('semgrep.sarif') != ''
         with:
           sarif_file: semgrep.sarif
@@ -118,8 +118,8 @@ jobs:
       - name: Run Bandit
         run: bandit -r apps/backend/src/ -f sarif -o bandit-results.sarif || true
       - name: Upload Bandit results
-        uses: github/codeql-action/upload-sarif@v3
-        if: always()
+        uses: github/codeql-action/upload-sarif@v4
+        if: always() && hashFiles('bandit-results.sarif') != ''
         with:
           sarif_file: bandit-results.sarif
 
@@ -147,9 +147,9 @@ jobs:
       - name: Install Checkov
         run: pip install checkov
       - name: Run Checkov
-        run: checkov -d docker/ -d . --skip-path apps/ --skip-path node_modules/ --output sarif --output-file-path checkov-results.sarif --quiet
+        run: checkov -d docker/ -d . --skip-path apps/ --skip-path node_modules/ --skip-path site/ --output sarif --output-file-path checkov-results.sarif --quiet
       - name: Upload Checkov results
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: checkov-results.sarif

.gitleaks.toml

@@ -3,8 +3,6 @@
 [extend]
 useDefault = true
 
-[[allowlist]]
+[allowlist]
 description = "Alembic migration revision IDs (hex hashes) are not API keys"
-paths = [
-    '''apps/backend/migrations/.*\.py'''
-]
+paths = ['apps/backend/migrations/.*\\.py']

Dockerfile

@@ -102,6 +102,7 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=3 \
     CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/api/v1/health', timeout=4)" || exit 1
 
+# checkov:skip=CKV_DOCKER_3: Process runs as breaker26 via gosu in entrypoint; root needed for volume chown.
 # Container starts as root so that the entrypoint can fix /data volume ownership at runtime,
 # then drops to breaker26 (UID 1000) via gosu before execing the app.
 # tini as PID 1 ensures SIGTERM is forwarded to uvicorn and zombie processes are reaped.

docker/docker-compose.prod.yml

@@ -11,6 +11,7 @@
 # CB_TAG must match the tag used when publishing (e.g. make docker-publish-prod TAG=v0.2.0 → use CB_TAG=v0.2.0, not 0.2.0).
 #
 # Requires: Caddyfile and .env in the same directory as this file.
+# Caddyfile must be a regular file (not a directory); bind-mounting a directory fails.
 name: circuitbreaker
 
 networks:

install.sh

@@ -422,7 +422,8 @@ Install_Docker() {
 Check_Docker() {
   if command -v docker >/dev/null 2>&1; then
     local ver major
-    ver=$(docker version --format '{{.Server.Version}}' 2>/dev/null || echo "0.0.0")
+    ver=$(docker version --format '{{.Server.Version}}' 2>/dev/null)
+    [[ -z "$ver" || "$ver" == "0.0.0" ]] && ver=$(docker version --format '{{.Client.Version}}' 2>/dev/null || echo "0.0.0")
     major="${ver%%.*}"
     if [[ "$major" -lt "$MINIMUM_DOCKER_VERSION" ]]; then
       Show 1 "Docker $ver is too old (minimum required: $MINIMUM_DOCKER_VERSION). Please upgrade Docker and re-run."