Phase 16: CI Dependency Audit, Security Checks & Image Hygiene - Discussion Log
Audit trail only. Do not use as input to planning, research, or execution agents.
Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.
Date: 2026-06-12
Phase: 16-ci-dependency-audit-and-security-checks
Areas discussed: Security-check baseline, Audit + outdated policy, Image-hygiene enforcement (999.17), Gating & noise posture
Security-Check Baseline
Which checks form the baseline (multiSelect)
| Option |
Description |
Selected |
| Secret scan on diff |
gitleaks/trufflehog scans the PR diff for committed secrets |
✓ |
| Static security lint |
eslint-plugin-security or CodeQL |
✓ |
| Trivy image scan |
scan built production image for OS/package CVEs |
✗ (later dropped) |
| Dependency-review action |
GitHub's PR action — depends on GitHub API, not on Gitea |
|
User's choice: Secret scan + static security lint + (initially) trivy — then dropped trivy in the follow-up.
Secret-scan scope
| Option |
Description |
Selected |
| Diff + one full-history scan |
per-PR diff + a one-time full-history baseline |
✓ |
| PR diff only |
only changed commits |
|
| Full tree every run |
whole repo every PR |
|
Trivy gate
| Option |
Description |
Selected |
| Publish-time, advisory |
scan image, never block |
|
| Publish-time, block on CRITICAL |
fail publish on CRITICAL |
|
| Per-PR (build image in PR) |
earliest feedback |
|
User's choice: "Drop Trivy for now. I don't want it in the backlog, but it can be some future thing if we need it." → Trivy removed from scope entirely.
Static security lint severity
| Option |
Description |
Selected |
| Warn (advisory) |
surfaced but non-blocking |
|
| Error (blocking) |
fails the lint gate |
✓ |
Notes: User accepts that blocking eslint-plugin-security will require triaging/disabling existing heuristic findings to reach green.
Audit + Outdated Policy
pnpm audit severity threshold
| Option |
Description |
Selected |
| High + Critical |
fail on high/critical |
✓ |
| Critical only |
fail only on critical |
|
| Moderate+ |
fail on moderate and above |
|
Waiver mechanism
| Option |
Description |
Selected |
| Allowlist file in repo |
committed advisory-ID list + reason + reviewer |
✓ |
| pnpm overrides / config |
auditConfig.ignore* in package.json |
|
| No waiver mechanism yet |
deal with it if/when it blocks |
|
Outdated reporting vs intentional pins
| Option |
Description |
Selected |
| Advisory PR comment, never gates |
pnpm outdated -r as PR comment |
|
| Advisory, job-log only |
print to job log |
|
| Skip outdated entirely |
rely on audit only |
|
User's choice: Deferred to researcher (OQ-01). "Version pins are fine but if there's an issue with them or if they are too far behind there should be a balance here." Outcome locked: advisory, never gates; researcher designs the "dangerously behind / pinned-version-has-advisory" flagging.
Image-Hygiene Enforcement (999.17)
Enforcement mechanism (multiSelect)
| Option |
Description |
Selected |
| Bake NODE_ENV=production into image |
engages devBypass hard guard in shipped image |
✓ |
| Boot-time refuse-to-boot |
throw + non-zero exit on prod + dev-bypass |
✓ |
| Build-time abort |
fail build/publish on dev target/arg |
|
Notes: publish.yml already pins --target production; the static CI assertion covers "stays that way."
CI assertion depth
| Option |
Description |
Selected |
| Static + boot smoke |
.dockerignore + --target assertion + run image with dangerous combo, assert refuses to boot |
✓ |
| Full filesystem forensics |
export image fs, grep for secrets/seed/.git |
|
| Static checks only |
no container built/run |
|
.dockerignore scope
| Option |
Description |
Selected |
| Secrets + dev + bulk |
.env*, seed-credential.mjs, .git, node_modules, dist, tests, e2e, .planning, *.sql, playwright artifacts |
✓ |
| Secrets-only minimal |
only secret/seed/data files |
|
| Researcher proposes the list |
capture intent, enumerate later |
|
Gating & Noise Posture
Job layout
| Option |
Description |
Selected |
| New 'security' job, parallel |
gitleaks+audit+outdated parallel to fast-checks |
|
| Fold into fast-checks |
steps in existing job |
|
| Researcher decides layout |
pick against runner constraints |
✓ |
Notes: Recommendation surfaced (dedicated parallel security job) but final decomposition left to researcher/planner.
Doc-only PR behavior
| Option |
Description |
Selected |
| Secret scan always; audit/outdated code-only |
gitleaks universal, audit/outdated behind changes filter |
✓ |
| All new checks code-only |
whole security job skips doc-only |
|
| All new checks always run |
run on every PR |
|
Result surfacing
| Option |
Description |
Selected |
| Job-log summary only |
advisory output to job log |
✓ |
| PR comment via Gitea API |
step posts/updates a PR comment |
|
Renovate / Dependabot
| Option |
Description |
Selected |
| Defer |
out of scope; capture as deferred |
✓ |
| In scope |
add upgrade-bot config this phase |
|
Claude's Discretion
- Job decomposition for the new PR-time checks (D-15) — researcher/planner.
- Exact secret-scan tool (gitleaks vs trufflehog) and exact
.dockerignore line list — researcher confirms.
Deferred Ideas
- Renovate / Dependabot automated dependency upgrades — future phase/backlog.
- Trivy / image CVE scanning — dropped, not backlogged (revisit only if needed).
- PR-comment surfacing of advisory results — deferred in favor of job-log-only.
- Stale pending todo
2026-06-10-gitea-ci-regression-and-docker-publish.md — already delivered in Phase 8; should be archived.
