ukeeper / ukeeper-readability

77%

master: 77%

LAST BUILD ON BRANCH worktree-ci-hardening

branch: worktree-ci-hardening

CHANGE BRANCH

x

Reset

Sync Branches

• worktree-ci-hardening
• ci-dockerhub-soft-fail
• ci/workflow-hardening
• cleaner_frontend_structure
• dependabot/docker/node-22
• dependabot/github_actions/github-actions-updates-14cb627f6c
• dependabot/github_actions/github-actions-updates-1ee787ebfb
• dependabot/github_actions/github-actions-updates-5714300483
• dependabot/github_actions/github-actions-updates-7aa8621bec
• dependabot/github_actions/github-actions-updates-afd9e15987
• dependabot/go_modules/backend/go-modules-updates-08b33d1c25
• dependabot/go_modules/backend/go-modules-updates-0bc617739e
• dependabot/go_modules/backend/go-modules-updates-407dd4786b
• dependabot/go_modules/backend/go-modules-updates-5e29427af7
• dependabot/go_modules/backend/go-modules-updates-5e519fa3dd
• dependabot/go_modules/backend/go-modules-updates-71a6db2b89
• dependabot/go_modules/backend/go-modules-updates-751992312c
• dependabot/go_modules/backend/go-modules-updates-a616c34cc0
• dependabot/go_modules/backend/go-modules-updates-c1eb5b8ad9
• dependabot/go_modules/backend/go-modules-updates-c2169da76e
• dependabot/go_modules/backend/go-modules-updates-d01d85479d
• dependabot/go_modules/backend/go-modules-updates-d6af324dbd
• dependabot/go_modules/backend/go-modules-updates-ec788c1f9d
• dependabot/go_modules/backend/go-modules-updates-f885172778
• dependabot/go_modules/backend/golang.org/x/crypto-0.31.0
• dependabot/go_modules/backend/golang.org/x/net-0.36.0
• dependabot/npm_and_yarn/frontend/npm-development-modules-updates-89027bf77e
• dependabot/npm_and_yarn/frontend/npm-development-modules-updates-e6f6ae78c6
• generic-updates
• htmx
• master
• modularise-retrieval
• openai-auto-extraction
• openai_rules_generator
• openai_rules_improver
• paskal/bump_modules
• paskal/clarify_comment
• paskal/cleanup_readme
• paskal/fix_build
• paskal/improve_docker_compose
• paskal/index_to_htmx
• paskal/migrate_to_htmx
• paskal/offline_tests
• paskal/remove_edit_html
• paskal/return_rule_id_on_update
• paskal/safe_password_check
• refs/tags/v0.1.0
• refs/tags/v0.1.1
• refs/tags/v0.1.2
• refs/tags/v0.2.0
• remove-jquery
• remove_chi
• typos_fixes
• umputun/add-chatgpt-endpoints
• update-deps-2026-04-11

Build # 23706411455

Build Type

Pull #72

github

Committed by paskal

Commit Message

build: harden CI, split docker workflow, update dependencies

- Split docker build into separate workflow with workflow_run trigger
- Harden against CI injection: env-var indirection for all expressions in
  run blocks, event=='push' guard on workflow_run trigger
- Replace unmaintained wbari/start-mongoDB action with native service container
- Update action versions: login v3→v4, build-push v6→v7,
  upload-artifact v4→v7, download-artifact v4→v8
- Fix dependabot gomod directory /backend → / (post structure flatten)
- Update all Go dependencies, removing vulnerable otel/sdk (CVE-2026-24051)
- Apply go fix: use builtin min(), range-over-int loops

Pull Request Pull Request #72: build: harden CI, split docker workflow, update dependencies

Coverage Stats

610 of 791 relevant lines covered (77.12%)

8.41 hits per line