fix snyk failures

[akshaydeo]

Summary

Improves Docker container security and reliability by migrating from custom base image to standard Alpine, adding health checks, and enhancing Snyk security scanning.

Changes

• Docker base image migration: Replaced bifrosthq/dhi-alpine-base:3.22-fips_bifrost-v27032026 with standard alpine:3.23.3 for better security and maintainability
• Added health checks: Implemented HTTP health check endpoint monitoring with 30s intervals and proper retry logic
• Enhanced user management: Consolidated user creation and permission setup into single RUN command for better layer optimization
• Improved Snyk scanning: Added build step before security scanning and excluded examples and tests/scripts directories from vulnerability analysis
• Runtime dependencies: Explicitly installed required CGO runtime libraries (musl, libgcc, ca-certificates, wget)

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (Next.js)
• Docs

How to test

Validate Docker builds and container health:

# Build and test standard Dockerfile
docker build -f transports/Dockerfile -t bifrost:test .
docker run -d --name bifrost-test -p 8080:8080 bifrost:test
docker ps  # Should show healthy status after ~35s
curl http://localhost:8080/health  # Should return 200 OK

# Build and test local development Dockerfile
docker build -f transports/Dockerfile.local -t bifrost:local .
docker run -d --name bifrost-local -p 8081:8080 bifrost:local
docker ps  # Should show healthy status after ~35s

# Test Snyk workflow
make build  # Verify build step works
# Run Snyk scan (requires SNYK_TOKEN)

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

• Migrated from custom base image to well-maintained Alpine Linux for better security patching
• Enhanced Snyk scanning excludes test directories to focus on production code vulnerabilities
• Health check endpoint provides better container monitoring capabilities
• Explicit runtime dependency management reduces attack surface

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9d18e887-86cb-4ff9-b079-7cb9330d13d0

📥 Commits

Reviewing files that changed from the base of the PR and between b1d1d5c and b12abde.

📒 Files selected for processing (3)

• .github/workflows/snyk.yml
• transports/Dockerfile
• transports/Dockerfile.local

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated Docker base image to Alpine 3.23.3 for improved security and performance
  • Added container health checks to monitor application availability
  • Enhanced CI security scanning to exclude example and test directories

Walkthrough

Updated CI/CD workflow to include a build step before Snyk scanning and modified analysis scope. Replaced custom Alpine base image with standard alpine:3.23.3 in both Dockerfile variants, added explicit runtime package installations, implemented healthcheck configuration, and reorganized permission handling during build and runtime stages.

Changes

Cohort / File(s)	Summary
CI/CD Workflow .github/workflows/snyk.yml	Added make build step before Snyk execution; updated Snyk Open Source command to exclude examples and test scripts directories with --exclude=examples,tests/scripts flag.
Docker Runtime Configuration transports/Dockerfile, transports/Dockerfile.local	Replaced custom base image with alpine:3.23.3; added explicit runtime package installations (musl, libgcc, ca-certificates, wget); introduced HEALTHCHECK directive polling http://127.0.0.1:${APP_PORT}/health; relocated chmod operations for entrypoint from build stage to runtime stage with new appuser/directory creation flow.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Alpine peaks so clean and bright,
Base images swapped for lighter weight,
Health checks pulse through the night,
Permissions dance in perfect state,
Snyk builds first, then scans with might!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 03-30-fix_snyk_failures

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[akshaydeo]

• fix snyk failures #2385 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

🧪 Test Suite Available

This PR can be tested by a repository admin.

Run tests for PR #2385

[akshaydeo]

Merge activity

• Mar 30, 8:18 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Mar 30, 8:19 AM UTC: @akshaydeo merged this pull request with Graphite.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — all remaining findings are P2 style/consistency issues that do not affect runtime behaviour.

No P0 or P1 issues found. The three comments are all P2: non-standard indentation (cosmetic), a missing trailing newline, and a missing SHA digest on the Dockerfile.local runtime base. The core logic changes are sound.

No files require special attention for merge safety; the Dockerfile.local SHA-pinning gap is worth a follow-up but is not blocking.

Important Files Changed

Filename	Overview
.github/workflows/snyk.yml	Adds a make build step before Snyk CLI in snyk-open-source job and excludes examples and tests/scripts directories from scanning to fix Snyk failures.
transports/Dockerfile	Replaces custom FIPS base image with standard alpine:3.23.3 (SHA-pinned), adds explicit appuser creation, installs CGO runtime deps, adds HEALTHCHECK, and fixes entrypoint chmod to happen in runtime stage — but all Dockerfile instructions are unconventionally indented 2 spaces and the file is missing a trailing newline.
transports/Dockerfile.local	Same migration as Dockerfile from custom base image to plain alpine:3.23.3, but without SHA digest pinning on the runtime base image (unlike Dockerfile); also has the same indentation and missing-newline issues.

_{Reviews (1): Last reviewed commit: "fix snyk failures" | Re-trigger Greptile}

[greptile-apps]

Non-standard Dockerfile indentation

All instructions in this file (and transports/Dockerfile.local) have been indented with 2 spaces. Standard Dockerfile syntax requires instructions to begin at column 0. While modern Docker with BuildKit is lenient about leading whitespace, this is non-standard, may confuse tooling (linters, IDE syntax highlighting, older Docker daemons), and is inconsistent with convention. Consider removing the leading whitespace from all instructions.

This same pattern applies throughout transports/Dockerfile.local as well.