gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-13 04:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): collapse repeated trivy-missing pre-deploy notifications (#1166)

Browse Source 
Scan policies on a node without Trivy installed previously fired one
"Pre-deploy scan skipped" warning per deploy, flooding the notification
feed during CI loops. Add a 60-minute per-(node, stack) cooldown so an
operator sees one actionable warning, not one per deploy. The boot log
line and the one-click managed install in Settings > Security are
unchanged; this only reshapes the per-deploy fanout.

Also tighten the vulnerability-scanning entry in /docs/features/overview
to point first-touch users at the one-click install on first use.
This commit is contained in:
Anso
2026-05-23 01:18:30 -04:00
committed by GitHub
parent e9af5c0d5d
commit 0947da13ae
3 changed files with 93 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/PolicyEnforcement.ts
+26 -12
View File
@@ -50,6 +50,30 @@ export interface PolicyEnforcementResult {
trivyMissing?: boolean;
}
const TRIVY_MISSING_NOTIFY_COOLDOWN_MS = 60 * 60 * 1000;
// Growth bounded by configured-policy fanout (only stacks with an enabled
// block_on_deploy policy can land here), not by total stack churn. Cleared
// on process restart, which is the right scope for an informational warning.
const trivyMissingNotifiedAt = new Map<string, number>();
function notifyTrivyMissingOnce(nodeId: number, stackName: string): void {
const key = `${nodeId}:${stackName}`;
const now = Date.now();
const last = trivyMissingNotifiedAt.get(key);
if (last !== undefined && now - last < TRIVY_MISSING_NOTIFY_COOLDOWN_MS) return;
trivyMissingNotifiedAt.set(key, now);
NotificationService.getInstance().dispatchAlert(
'warning',
'scan_finding',
`Pre-deploy scan for "${stackName}" skipped: Trivy not installed on this node`,
{ stackName },
);
}
export function _resetTrivyMissingNotificationStateForTests(): void {
trivyMissingNotifiedAt.clear();
}
export async function enforcePolicyPreDeploy(
stackName: string,
nodeId: number,
@@ -68,12 +92,7 @@ export async function enforcePolicyPreDeploy(
const svc = TrivyService.getInstance();
if (!svc.isTrivyAvailable()) {
NotificationService.getInstance().dispatchAlert(
'warning',
'scan_finding',
`Pre-deploy scan for "${stackName}" skipped: Trivy not installed on this node`,
{ stackName },
);
notifyTrivyMissingOnce(nodeId, stackName);
return { ok: true, bypassed: false, policy, violations: [], trivyMissing: true };
}
@@ -117,12 +136,7 @@ export async function enforcePolicyForImageRefs(
const svc = TrivyService.getInstance();
if (!svc.isTrivyAvailable()) {
NotificationService.getInstance().dispatchAlert(
'warning',
'scan_finding',
`Pre-deploy scan for "${stackName}" skipped: Trivy not installed on this node`,
{ stackName },
);
notifyTrivyMissingOnce(nodeId, stackName);
return { ok: true, bypassed: false, policy, violations: [], trivyMissing: true };
}