feat(ci): #314 — authenticated black-box security scan + Microsoft.OpenApi HIGH-vuln pin #331

Merged

timothy merged 3 commits from fix/314-security-scan into main

2026-07-13 08:42:43 +02:00

Author	SHA1	Message	Date
timothyandClaude Opus 4.8	a042623a53	fix(ci): #314 review — reap ZAP container in the cleanup() trap; warn on missing semgrep Build ErsatzTV Image / decisions.md append-only (pull_request) Successful in 6s Details Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 7s Details Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 15s Details Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 16s Details Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 4m34s Details Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 5m40s Details Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped Details Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (push) Has been skipped Details Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (push) Has been skipped Details Build ErsatzTV Image / Docs update reminder (push) Has been skipped Details Build ErsatzTV Image / decisions.md append-only (push) Has been skipped Details Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (push) Successful in 4m34s Details Build ErsatzTV Image / Build & test (.NET) (push) Successful in 5m39s Details Build ErsatzTV Image / Build & push image (amd64) (push) Successful in 4m35s Details Cold review of PR #331: - Move the ZAP-container reap from an inline post-scan line into cleanup() (the EXIT trap) so a SIGINT/timeout kill mid-scan can't leave it running. - semgrep absent now prints a stderr WARN instead of silently skipping the SAST pass (no false confidence for a release gate). refs #314 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:36:08 +02:00
timothyandClaude Opus 4.8	366d5d316c	feat(ci): #314 — repeatable black-box security scan (authenticated ZAP + semgrep) Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 9s Details Build ErsatzTV Image / decisions.md append-only (pull_request) Successful in 10s Details Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 15s Details Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 15s Details Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 10m1s Details Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 10m55s Details Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped Details scripts/security-scan.sh: boots a THROWAWAY container from the image under test (fresh config volume; never the deployed prod/test container — the active scan attacks write endpoints), reads its machine key, and runs an authenticated OWASP ZAP api-scan that imports /openapi/v1.json (all 160 /api/v1 ops) and injects X-Api-Key on every request via a replacer rule so it reaches the [RequiresAuthentication] + RequireKeyForReads surface — then a semgrep SAST cross-check. Wrapped in `timeout` because zap-api-scan can hang in post-scan cleanup after the report is already written. docs/ci-cd.md: new 'Security scanning' section (out-of-ecosystem black-box gate, run on the docker host per-release like migration-smoke, not a per-PR CI job) + the Microsoft.OpenApi 2.7.5 pin note in dependency management. refs #314 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:28:13 +02:00
timothyandClaude Opus 4.8	940af13a5f	fix(deps): #314 — pin Microsoft.OpenApi 2.7.5 (GHSA-v5pm-xwqc-g5wc, High) Microsoft.AspNetCore.OpenApi 10.0.2 + Scalar.AspNetCore pull Microsoft.OpenApi 2.0.0 transitively — High severity (stack overflow parsing a circular $ref; fixed in 2.7.5). Direct-pin 2.7.5 in CPM + a direct ErsatzTV PackageReference so the override actually resolves (the #8 SQLitePCLRaw transitive-override pattern). Build clean (transformers compile unchanged against 2.7.5), v1.json byte-identical (no OpenAPI-output change), ErsatzTV + ErsatzTV.Tests both vuln-clear, 198 OpenAPI/contract/security tests green. refs #314 #8 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:09:30 +02:00