ci(security): add secret scan and SBOM

2026-08-30 22:22:19 +02:00
parent 9ad812e9ba
commit 8c3822c440
9 changed files with 330 additions and 6 deletions
@@ -241,3 +241,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-207 | Ownership/migration chain; populated aggregate adoption/downgrade/retry; JSON/text/FK/index assertions; MariaDB script; full backend | Repository root / disposable local SQLite | Move the canonical Career Profile, append-only history, and six relational child types to migration ownership without losing career data | PASS — focused ownership/migration 19/19; canonical and long-tail JSON, Norwegian text, version history, experience, education, skill, project, certification and language rows survive adoption, downgrade and re-upgrade; all 14 aggregate indexes exist; deleting the profile cascades through history and children; generated MariaDB SQL uses bounded indexed keys and provider-safe types; startup creates none of the eight tables; full backend 735/735 | MariaDB SQL generated only; no production migration. Guarded historical LongTailJson/index/auto-increment repairs remain temporarily. Seven reconciler-owned Identity tables remain | JT-019 feature and career transfers complete; isolate the Identity ownership boundary next |
 | V-208 | Ownership/migration chain; populated Identity adoption/downgrade/retry; credential/preference/FK/index assertions; MariaDB script; full backend; fresh application startup | Repository root / disposable local SQLite | Complete JT-019 by moving the seven ASP.NET Identity tables to migration ownership without invalidating authentication data | PASS — focused ownership/migration 20/20; password hash, Bokmål preference, 2FA state, role assignment, role/user claims, external login and token survive adoption, downgrade and re-upgrade; all eight Identity indexes exist; user and role deletion cascades remain effective; generated MariaDB SQL is provider-safe; startup creates no model tables; full backend 736/736; a fresh application applies the complete chain, reaches Identity role initialization and listens normally | MariaDB SQL generated only; no production migration. The historical AspNetUsers compatibility bootstrap and guarded column/index repairs remain for chain traversal and legacy upgrades. Launch settings supplied an existing policy-invalid development admin password, producing a non-fatal seed warning | JT-019 complete; future work may retire individual repair statements only after provider-backed historical fixtures prove them redundant |
 | V-209 | Google Identity initialization regression; focused login Jest; ESLint; TypeScript; complete Playwright | `job-tracker-ui` / disposable local application | Remove repeated global Google SDK initialization without changing sign-in or account-link behavior | PASS — SDK initialization is stable per loaded Identity API/client ID while the mounted card owns the current credential handler; login 13/13, lint and TypeScript pass; Playwright 10/10 covers authentication, job creation/workspace, Career Workspace and searchable PDF exports with no repeated-initialize warning | Synthetic Google callback only; no real provider credential, account link or production call | Repeatable browser-console defect closed; real-provider verification remains externally gated |
+| V-210 | Standard-library supply-chain tests; tracked-tree credential scan; deterministic multi-lock CycloneDX generation; CI/policy review | Repository root | Add locally provable JT-017 SBOM and secret gates without trusting new mutable tooling | PASS/PARTIAL — 3/3 tests detect seven synthetic credential classes without returning values, ignore binary/oversized inputs and prove deterministic npm/NuGet/PyPI coverage; the tracked tree is clean; generated CycloneDX 1.5 contains 964 unique locked components; CI now blocks findings and generates the SBOM | Scanner is intentionally high-confidence/current-tree only. SBOM is not yet retained by CI. Docker daemon/scanner and verified upstream action/image/installer identifiers are unavailable; Torch/Transformers findings remain unaccepted | Local secret/SBOM controls complete; immutable input, container/licence and model-stack gates remain JT-017 |