42098721709
84%

Ran 05 Nov 2026 08:17PM UTC

Jobs 1

Files 60

Run time 1min

Badge

Embed ▾

Committed 05 Nov 2026 07:56PM UTC coverage: 84.045% (-0.008%) from 84.053%

Build # 42098721709

Build Type

push

github

Committed by

web-flow

Commit Message

feat(ci): gate releases on vulnerability findings and scan main nightly (#953)

Every operator, agent and CLI tag now fails on a fixable critical or high
finding that .openvex.json does not suppress. For the images the gate runs
after the per-platform push and before the version index is created; for
the CLI, after the push and before signing. It prints no findings, since a
release log is public; `make vuln-scan IMAGE=...` reproduces them locally.

The scheduled scan now runs daily and answers two questions separately:
main-built images (a new moving `main` tag) are filed under main, and each
component's newest stable release under its release branch, so the
Security tab's default view is "what to fix now" and a release branch
shows "what users pull". `make vuln-status` prints both.

Closes #630

Signed-off-by: Brian Lockwood <lockwobr@gmail.com>

Coverage Stats

10419 of 12397 relevant lines covered (84.04%)

7.74 hits per line

Coverage Regressions

Lines	Coverage	∆	File
3	84.9	-0.04%	operator/internal/controller/skyhook_controller.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	42098721709.1	05 Nov 2026 08:17PM UTC	60	84.04	GitHub Action Run

NVIDIA / nodewright / 42098721709
84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 42098721709

NVIDIA / nodewright / 42098721709 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 42098721709

NVIDIA / nodewright / 42098721709
84%

README BADGES
x