timothy/ersatztv
1
0
Fork 0
Code Issues 58 Pull Requests 8 Actions Packages Projects Releases 9 Wiki Activity

docs(931): a failing setup command's exit is its own status, and the Hosts row names no excluded host
Build ErsatzTV Image / CI toolchain image resolves (pull_request) Successful in 8s
Details
Build ErsatzTV Image / Delimiter ban (release path) (pull_request) Successful in 20s
Details
PR Gates / CI image pin matches docker/ci (pull_request) Successful in 17s
Details
PR Gates / Docs update reminder (pull_request) Successful in 10s
Details
PR Gates / decisions lifecycle (pull_request) Successful in 17s
Details
PR Gates / Fix proofs (Proves trailers) (pull_request) Successful in 17s
Details
Review verdict / Set review-verdict status (pull_request_target) Successful in 15s
Details
PR Gates / Script lint and tests (ruff + pytest) (pull_request) Successful in 13m5s
Details
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 9m9s
Details
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 5m55s
Details
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Skipped
Details
Build ErsatzTV Image / Functional E2E (curl + UI contracts) (pull_request) Successful in 5m50s
Details
Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 7s
Details
Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 5s
Details
review-verdict/h10 Review-verdict: MERGEABLE @ f71e2fd (base: main)
Details

Browse Source 
The exit list gave "any other code" to a set -e setup failure, but `docker pull`
usually exits 1, which collides with the ZAP FAIL code; it now says such a
failure exits with that command's own status. The jazz Hosts row said the scan
runs "not [on] this one", which would stay wrong once jazz gets semgrep; it now
says any docker host that meets the requirements.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1
This commit is contained in:
timothy
2026-10-30 00:03:24 +01:00
co-authored by Claude Opus 5.5
parent 0e64328ca2
commit f71e2fd0d0
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ci-cd.md
+2 -2
View File
@@ -9,7 +9,7 @@ server-management#481.
| Host | IP | Role | | Host | IP | Role |
|---|---|---| |---|---|---|
| **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target, so it needs a docker host that meets its requirements (Security scanning → Where/when), not this one. | | **jazz** | 192.168.1.29 | **Docker host for the media transcoders** — prod `ersatztv` (8409), `ersatztv-test` (8410), Jellyfin. The prod-copy `migration-smoke.sh` runs here. The release scan (`security-scan.sh`) boots its own throwaway target from the registry, so it runs on any docker host that meets its requirements (Security scanning → Where/when). |
| **bumblebee** | 192.168.1.99 | CI runners (`bumblebee-runner`, `small-runner`), plus every other Docker stack. All the memory/lane measurements below were taken here. | | **bumblebee** | 192.168.1.99 | CI runners (`bumblebee-runner`, `small-runner`), plus every other Docker stack. All the memory/lane measurements below were taken here. |
| **ci-runner** | VM 127 (pve4) | The other `ubuntu-latest` CI runner. | | **ci-runner** | VM 127 (pve4) | The other `ubuntu-latest` CI runner. |
@@ -2694,7 +2694,7 @@ running product from outside our C#/review stack.
tool error, or the throwaway target never came up or its key was unreadable; **2** — *not* ZAP's WARN — tool error, or the throwaway target never came up or its key was unreadable; **2** — *not* ZAP's WARN —
a scanner half did not run: semgrep missing (before the scan) or erroring (after it), or docker a scanner half did not run: semgrep missing (before the scan) or erroring (after it), or docker
missing; if ZAP already classified non-zero, that status stands and the semgrep error prints beside missing; if ZAP already classified non-zero, that status stands and the semgrep error prints beside
it; **any other** code is a setup command (e.g. `docker pull`) failing under `set -e`. Run it. A setup command that fails under `set -e` (e.g. `docker pull`) exits with its own status. Run
`scripts/security-scan.sh --selftest` for a docker-free regression check: it pins every ZAP `scripts/security-scan.sh --selftest` for a docker-free regression check: it pins every ZAP
classification, and runs the script itself with shimmed tools (ZAP reporting clean) to pin the classification, and runs the script itself with shimmed tools (ZAP reporting clean) to pin the
semgrep gate — missing → exit 2 before docker is checked, erroring → 2, succeeding → 0 with semgrep semgrep gate — missing → exit 2 before docker is checked, erroring → 2, succeeding → 0 with semgrep
scripts/security-scan.sh
+1 -1
View File
@@ -39,7 +39,7 @@
# 2 NOT ZAP's WARN: a scanner half did not run — semgrep missing (checked before the scan) or erroring # 2 NOT ZAP's WARN: a scanner half did not run — semgrep missing (checked before the scan) or erroring
# (after it), or docker missing. If ZAP already classified non-zero, that status stands and the # (after it), or docker missing. If ZAP already classified non-zero, that status stands and the
# semgrep error is printed alongside it. # semgrep error is printed alongside it.
# other a setup command failed under `set -e` (e.g. `docker pull`), exiting with that command's status # A setup command that fails under `set -e` (e.g. `docker pull`) exits with that command's own status.
set -euo pipefail set -euo pipefail