Skip to content

fix(security): resolve 6 final CodeQL alerts #654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
POWERFULMOVES merged 8 commits into from
Feb 18, 2026
Merged

fix(security): resolve 6 final CodeQL alerts #654

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ba606b7
Merge pull request #621 from POWERFULMOVES/PMOVES.AI-Edition-Hardened
POWERFULMOVES Feb 16, 2026
5e5557a
chore(deps)(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34…
dependabot[bot] Feb 16, 2026
063560b
chore(deps)(deps): bump anchore/sbom-action from 0.21.0 to 0.22.2 (#631)
dependabot[bot] Feb 16, 2026
acea612
Merge pull request #647 from POWERFULMOVES/PMOVES.AI-Edition-Hardened
POWERFULMOVES Feb 17, 2026
48a06aa
fix(security): resolve 6 final CodeQL alerts across gateway and yt se…
hunnibear Feb 18, 2026
7831576
fix(security): address CodeRabbit findings — JSONDecodeError, request…
hunnibear Feb 18, 2026
b612de5
docs(chit): add CHIT Gateway API reference and update implementation …
hunnibear Feb 18, 2026
c1fcd9a
docs(readme): overhaul README — 5 CI badges, CHIT section, expanded s…
hunnibear Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/integrations-ghcr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,7 +343,7 @@ jobs:

- name: Install Syft (SBOM)
if: ${{ matrix.generate_sbom && steps.meta.outputs.has_tags == 'true' }}
uses: anchore/sbom-action/download-syft@v0.21.0
uses: anchore/sbom-action/download-syft@v0.22.2

- name: Generate SBOMs (CycloneDX)
id: sbom
Expand Down Expand Up @@ -377,7 +377,7 @@ jobs:

- name: Trivy vulnerability scan (HIGH/CRITICAL)
if: ${{ steps.meta.outputs.has_tags == 'true' }}
uses: aquasecurity/trivy-action@0.33.1
uses: aquasecurity/trivy-action@0.34.0
with:
# Gate on HIGH/CRITICAL with fixes available (vendor/unfixed CVEs are still surfaced by the next step).
# This avoids blocking nightly builds on upstream issues we can't remediate immediately, while keeping
Expand All @@ -393,7 +393,7 @@ jobs:

- name: Trivy vulnerability scan report (includes unfixed)
if: ${{ steps.meta.outputs.has_tags == 'true' }}
uses: aquasecurity/trivy-action@0.33.1
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: ${{ steps.meta.outputs.primary_tag }}
format: table
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/self-hosted-builds-hardened.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ jobs:

- name: Scan Ollama CUDA with Trivy
if: github.event_name != 'pull_request'
uses: aquasecurity/trivy-action@0.33.1
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: ${{ env.IMAGE_PREFIX }}/pmoves-ollama:cuda-${{ github.sha }}
format: sarif
Expand Down Expand Up @@ -130,7 +130,7 @@ jobs:

- name: Scan Hi-RAG GPU with Trivy
if: github.event_name != 'pull_request'
uses: aquasecurity/trivy-action@0.33.1
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: ${{ env.IMAGE_PREFIX }}/pmoves-hirag-gateway:gpu-${{ github.sha }}
format: sarif
Expand Down Expand Up @@ -249,7 +249,7 @@ jobs:

- name: Scan ${{ matrix.service.name }} with Trivy
if: github.event_name != 'pull_request'
uses: aquasecurity/trivy-action@0.33.1
uses: aquasecurity/trivy-action@0.34.0
with:
image-ref: ${{ env.IMAGE_PREFIX }}/pmoves-${{ matrix.service.name }}:${{ github.sha }}
format: sarif
Expand Down
203 changes: 133 additions & 70 deletions README.md
View file
Open in desktop

Large diffs are not rendered by default.

Loading
Loading