mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 20:00:08 +00:00
Anso
3668c71860
* feat(security): add SBOM attestations, VEX document, and retire .trivyignore Add OpenVEX triage document (security/vex/sencho.openvex.json) for the 5 residual CVEs vendored inside docker/compose v5.1.2 that were carried over from the previous PR. All 5 are marked not_affected with justifications. Configure Trivy in both CI and release workflows to consume the VEX document via trivy.yaml so the same source of truth gates PR scans and release scans. Delete .trivyignore, which is fully superseded by the VEX file. Add two new release pipeline steps after image publication: - CycloneDX 1.6 SBOM via anchore/sbom-action (also installs syft) - SPDX 2.3 SBOM via syft directly (reuses OCI layer cache from prior step) Both are attached as cosign OCI referrer attestations (keyless, OIDC-signed) and uploaded as GitHub Release assets alongside the OpenVEX file. Bump docker-publish.yml permissions from contents:read to contents:write, required for softprops/action-gh-release to create Release assets. Add docs/operations/verifying-images.mdx with copy-paste verification commands for all supply-chain artifacts: signature, SLSA provenance, CycloneDX SBOM, SPDX SBOM, OpenVEX, and Rekor entry. Update docs.json navigation and expand the Supply chain security section in docs/security.mdx. Add a Verifying Release Artifacts section to SECURITY.md. * fix(vex): cover otel SDK CVE-2026-39883 in rebuilt Docker CLI binary The rebuilt Docker CLI v29.4.0 vendors otel/sdk v1.42.0, which still contains CVE-2026-39883 (BSD kenv PATH hijacking; fixed in v1.43.0). docker-compose v5.1.2 vendors otel/sdk v1.38.0 separately. The original VEX statement only covered the compose binary's location and version, so Trivy's scan of /usr/local/bin/docker was not suppressed. Add a second subcomponent entry for the CLI binary path with the correct vendored version. The not_affected justification (BSD-only code path; we ship linux/amd64 and linux/arm64 only) holds for both binaries. * fix(ci): use list form for vulnerability.vex in trivy.yaml Trivy's config schema requires vulnerability.vex to be a list (mapped to the multi-value --vex flag). The previous bare-string value was silently dropped, so the OpenVEX document was never loaded and HIGH findings already covered by VEX statements still failed the scan. * fix(ci): mirror VEX CVE in .trivyignore for local-image scan Trivy does not emit an OCI purl for locally-built images without a RepoDigests entry (aquasecurity/trivy#9399), so OpenVEX product matching against the CI build target sencho:pr-test resolves to no artifact and every statement is silently dropped. The VEX document remains the canonical triage record and is still attached as a cosign attestation on the published image; this file just mirrors the single CVE that surfaces on the local scan so CI does not block on a finding already triaged in VEX. Updates the Trivy step comment to document the relationship between the two files.
290 lines
8.6 KiB
JSON
290 lines
8.6 KiB
JSON
{
|
|
"$schema": "https://mintlify.com/docs.json",
|
|
"theme": "mint",
|
|
"name": "Sencho",
|
|
"colors": {
|
|
"primary": "#00BEC7",
|
|
"light": "#007982",
|
|
"dark": "#00BEC7"
|
|
},
|
|
"logo": {
|
|
"light": "/images/logo/logo-light.png",
|
|
"dark": "/images/logo/logo-dark.png",
|
|
"href": "https://sencho.io"
|
|
},
|
|
"favicon": "/images/logo/favicon.ico",
|
|
"appearance": {
|
|
"default": "dark"
|
|
},
|
|
"fonts": {
|
|
"family": "Geist"
|
|
},
|
|
"background": {
|
|
"decoration": "gradient",
|
|
"color": {
|
|
"dark": "#090909"
|
|
}
|
|
},
|
|
"navbar": {
|
|
"links": [
|
|
{
|
|
"type": "github",
|
|
"href": "https://github.com/AnsoCode/Sencho"
|
|
}
|
|
],
|
|
"primary": {
|
|
"type": "button",
|
|
"label": "Get Started",
|
|
"href": "https://sencho.io/#pricing"
|
|
}
|
|
},
|
|
"footer": {
|
|
"socials": {
|
|
"github": "https://github.com/AnsoCode/Sencho"
|
|
},
|
|
"links": [
|
|
{
|
|
"header": "Product",
|
|
"items": [
|
|
{ "label": "Website", "href": "https://sencho.io" },
|
|
{ "label": "Pricing", "href": "https://sencho.io/#pricing" },
|
|
{ "label": "Changelog", "href": "https://github.com/AnsoCode/Sencho/releases" }
|
|
]
|
|
},
|
|
{
|
|
"header": "Community",
|
|
"items": [
|
|
{ "label": "GitHub", "href": "https://github.com/AnsoCode/Sencho" },
|
|
{ "label": "Contributing", "href": "https://github.com/AnsoCode/Sencho/blob/main/CONTRIBUTING.md" }
|
|
]
|
|
},
|
|
{
|
|
"header": "Legal",
|
|
"items": [
|
|
{ "label": "Terms of Service", "href": "https://sencho.io/terms" },
|
|
{ "label": "Privacy Policy", "href": "https://sencho.io/privacy" }
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"api": {
|
|
"auth": {
|
|
"method": "bearer",
|
|
"name": "Authorization"
|
|
},
|
|
"playground": {
|
|
"display": "simple"
|
|
}
|
|
},
|
|
"navigation": {
|
|
"tabs": [
|
|
{
|
|
"tab": "Documentation",
|
|
"groups": [
|
|
{
|
|
"group": "Getting Started",
|
|
"pages": [
|
|
"getting-started/introduction",
|
|
"getting-started/quickstart",
|
|
"getting-started/configuration",
|
|
"getting-started/sso-quickstart"
|
|
]
|
|
},
|
|
{
|
|
"group": "Features",
|
|
"pages": [
|
|
"features/overview",
|
|
"features/dashboard",
|
|
"features/global-search",
|
|
"features/sidebar",
|
|
"features/stack-management",
|
|
"features/editor",
|
|
"features/stack-file-explorer",
|
|
"features/deploy-progress",
|
|
"features/resources",
|
|
"features/app-store",
|
|
"features/global-observability",
|
|
"features/host-console",
|
|
"features/multi-node",
|
|
"features/pilot-agent",
|
|
"features/fleet-view",
|
|
"features/fleet-sync",
|
|
"features/remote-updates",
|
|
"features/stack-labels",
|
|
"features/alerts-notifications",
|
|
"features/notification-routing",
|
|
"features/webhooks",
|
|
"features/git-sources",
|
|
"features/rbac",
|
|
"features/atomic-deployments",
|
|
"features/fleet-backups",
|
|
"features/audit-log",
|
|
"features/api-tokens",
|
|
"features/private-registries",
|
|
"features/vulnerability-scanning",
|
|
"features/deploy-enforcement",
|
|
"features/cve-suppressions",
|
|
"features/auto-update-policies",
|
|
"features/auto-heal-policies",
|
|
"features/scheduled-operations",
|
|
"features/sso",
|
|
"features/two-factor-authentication",
|
|
"features/licensing"
|
|
]
|
|
},
|
|
{
|
|
"group": "Reference",
|
|
"pages": [
|
|
"security",
|
|
"features/node-compatibility",
|
|
"reference/settings",
|
|
"reference/contact",
|
|
"reference/security-advisories"
|
|
]
|
|
},
|
|
{
|
|
"group": "Operations",
|
|
"pages": [
|
|
"operations/troubleshooting",
|
|
"operations/backup",
|
|
"operations/upgrade",
|
|
"operations/self-hosting",
|
|
"operations/trivy-setup",
|
|
"operations/two-factor-admin",
|
|
"operations/verifying-images"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"tab": "API Reference",
|
|
"openapi": "openapi.yaml",
|
|
"pages": [
|
|
"api-reference/overview",
|
|
"api-reference/security",
|
|
{
|
|
"group": "Health & Meta",
|
|
"pages": [
|
|
"GET /api/health",
|
|
"GET /api/meta",
|
|
"POST /api/system/update"
|
|
]
|
|
},
|
|
{
|
|
"group": "Stacks",
|
|
"pages": [
|
|
"GET /api/stacks",
|
|
"POST /api/stacks",
|
|
"GET /api/stacks/{stackName}",
|
|
"PUT /api/stacks/{stackName}",
|
|
"DELETE /api/stacks/{stackName}",
|
|
"GET /api/stacks/{stackName}/envs",
|
|
"GET /api/stacks/{stackName}/env",
|
|
"PUT /api/stacks/{stackName}/env",
|
|
"GET /api/stacks/{stackName}/containers",
|
|
"GET /api/stacks/{stackName}/services",
|
|
"POST /api/stacks/{stackName}/deploy",
|
|
"POST /api/stacks/{stackName}/down",
|
|
"POST /api/stacks/{stackName}/start",
|
|
"POST /api/stacks/{stackName}/stop",
|
|
"POST /api/stacks/{stackName}/restart",
|
|
"POST /api/stacks/{stackName}/update",
|
|
"POST /api/stacks/{stackName}/rollback",
|
|
"GET /api/stacks/{stackName}/backup"
|
|
]
|
|
},
|
|
{
|
|
"group": "Containers",
|
|
"pages": [
|
|
"GET /api/containers",
|
|
"GET /api/containers/{id}/logs",
|
|
"POST /api/containers/{id}/start",
|
|
"POST /api/containers/{id}/stop",
|
|
"POST /api/containers/{id}/restart"
|
|
]
|
|
},
|
|
{
|
|
"group": "API Tokens",
|
|
"pages": [
|
|
"POST /api/api-tokens",
|
|
"GET /api/api-tokens",
|
|
"DELETE /api/api-tokens/{id}"
|
|
]
|
|
},
|
|
{
|
|
"group": "Webhooks",
|
|
"pages": [
|
|
"GET /api/webhooks",
|
|
"POST /api/webhooks",
|
|
"PUT /api/webhooks/{id}",
|
|
"DELETE /api/webhooks/{id}",
|
|
"GET /api/webhooks/{id}/history",
|
|
"POST /api/webhooks/{id}/trigger"
|
|
]
|
|
},
|
|
{
|
|
"group": "Nodes",
|
|
"pages": [
|
|
"GET /api/nodes",
|
|
"POST /api/nodes",
|
|
"GET /api/nodes/{id}",
|
|
"PUT /api/nodes/{id}",
|
|
"DELETE /api/nodes/{id}",
|
|
"POST /api/nodes/{id}/test",
|
|
"GET /api/nodes/{id}/meta"
|
|
]
|
|
},
|
|
{
|
|
"group": "Fleet",
|
|
"pages": [
|
|
"GET /api/fleet/overview",
|
|
"GET /api/fleet/node/{nodeId}/stacks",
|
|
"GET /api/fleet/node/{nodeId}/stacks/{stackName}/containers",
|
|
"GET /api/fleet/update-status",
|
|
"POST /api/fleet/nodes/{nodeId}/update",
|
|
"POST /api/fleet/update-all",
|
|
"POST /api/fleet/snapshots",
|
|
"GET /api/fleet/snapshots",
|
|
"GET /api/fleet/snapshots/{id}",
|
|
"POST /api/fleet/snapshots/{id}/restore",
|
|
"DELETE /api/fleet/snapshots/{id}"
|
|
]
|
|
},
|
|
{
|
|
"group": "Scheduled Tasks",
|
|
"pages": [
|
|
"GET /api/scheduled-tasks",
|
|
"POST /api/scheduled-tasks",
|
|
"GET /api/scheduled-tasks/{id}",
|
|
"PUT /api/scheduled-tasks/{id}",
|
|
"DELETE /api/scheduled-tasks/{id}",
|
|
"PATCH /api/scheduled-tasks/{id}/toggle",
|
|
"POST /api/scheduled-tasks/{id}/run",
|
|
"GET /api/scheduled-tasks/{id}/runs",
|
|
"GET /api/scheduled-tasks/{id}/runs/export"
|
|
]
|
|
},
|
|
{
|
|
"group": "Registries",
|
|
"pages": [
|
|
"GET /api/registries",
|
|
"POST /api/registries",
|
|
"PUT /api/registries/{id}",
|
|
"DELETE /api/registries/{id}",
|
|
"POST /api/registries/{id}/test"
|
|
]
|
|
},
|
|
{
|
|
"group": "Image Updates",
|
|
"pages": [
|
|
"GET /api/image-updates",
|
|
"POST /api/image-updates/refresh",
|
|
"GET /api/image-updates/status"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|