mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-09 02:12:59 +00:00
Anso
7ce045accb
* feat: pre-deploy scan visibility and pinned scanner version Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a manual deploy can surface each image's latest scan before it runs. - Managed Trivy now installs a pinned, known-good version by default for reproducible installs. Auto-update still tracks the latest release, and an explicit update always pulls the latest. - Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from the editor first shows each image's latest cached scan severity for review. It is visibility only and never blocks; deploy enforcement is unchanged. - Backend: pre_deploy_scan_advisory setting, PUT /security/pre-deploy-scan-advisory, a cache-only GET /security/stacks/:name/pre-deploy-summary, and a node-scoped getLatestVulnScanByDigestForNode lookup. - Frontend: advisory toggle on the Security page scanner setup, and a PreDeployScanDialog wired into the editor deploy flow that fails open when the summary is unavailable. - Docs: scanner configuration, version pinning, and the advisory. * fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state Addresses review findings on the pre-deploy advisory. - Block a second editor deploy during the async advisory window with a synchronous pending ref, cleared on cancel and in the deploy's finally, so a double-click can no longer start two deploys. - Keep the pre-deploy advisory toggle visible to admins whenever the setting is on, so it can still be turned off after the scanner becomes unavailable. - Resolve the managed Trivy version inside the install lock so the busy state and serialization cover the latest-version fetch and the managed-install check.
90 lines
3.8 KiB
TypeScript
90 lines
3.8 KiB
TypeScript
/**
|
|
* Managed Trivy install/update version selection.
|
|
*
|
|
* A normal managed install pins to a known-good bundled version for
|
|
* reproducibility; opting into auto-update tracks the latest release; and an
|
|
* explicit Update always pulls the latest regardless of the auto-update setting.
|
|
* The download itself (doInstall) is mocked so these stay offline and fast.
|
|
*/
|
|
import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
|
|
import { setupTestDb, cleanupTestDb } from './helpers/setupTestDb';
|
|
|
|
let tmpDir: string;
|
|
let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
|
|
let TrivyInstaller: typeof import('../services/TrivyInstaller').default;
|
|
|
|
// The pinned default the installer must use when auto-update is off. Kept in
|
|
// sync with PINNED_TRIVY_VERSION in TrivyInstaller.ts.
|
|
const PINNED = '0.70.0';
|
|
|
|
type InstallerInternals = { doInstall: (version: string) => Promise<{ version: string }> };
|
|
|
|
beforeAll(async () => {
|
|
tmpDir = await setupTestDb();
|
|
({ DatabaseService } = await import('../services/DatabaseService'));
|
|
TrivyInstaller = (await import('../services/TrivyInstaller')).default;
|
|
});
|
|
|
|
afterAll(() => cleanupTestDb(tmpDir));
|
|
|
|
afterEach(() => {
|
|
vi.restoreAllMocks();
|
|
DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '0');
|
|
});
|
|
|
|
describe('TrivyInstaller managed version selection', () => {
|
|
it('install() pins to the bundled version by default (auto-update off)', async () => {
|
|
const installer = TrivyInstaller.getInstance();
|
|
DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '0');
|
|
const fetchLatest = vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.99.0');
|
|
const doInstall = vi
|
|
.spyOn(installer as unknown as InstallerInternals, 'doInstall')
|
|
.mockResolvedValue({ version: PINNED });
|
|
|
|
await installer.install();
|
|
|
|
expect(fetchLatest).not.toHaveBeenCalled();
|
|
expect(doInstall).toHaveBeenCalledWith(PINNED);
|
|
});
|
|
|
|
it('install() tracks the latest release when auto-update is on', async () => {
|
|
const installer = TrivyInstaller.getInstance();
|
|
DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '1');
|
|
const fetchLatest = vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.99.0');
|
|
const doInstall = vi
|
|
.spyOn(installer as unknown as InstallerInternals, 'doInstall')
|
|
.mockResolvedValue({ version: '0.99.0' });
|
|
|
|
await installer.install();
|
|
|
|
expect(fetchLatest).toHaveBeenCalled();
|
|
expect(doInstall).toHaveBeenCalledWith('0.99.0');
|
|
});
|
|
|
|
it('update() always installs the latest release, even with auto-update off', async () => {
|
|
const installer = TrivyInstaller.getInstance();
|
|
DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '0');
|
|
vi.spyOn(installer, 'isManagedInstalled').mockReturnValue(true);
|
|
const fetchLatest = vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.99.0');
|
|
const doInstall = vi
|
|
.spyOn(installer as unknown as InstallerInternals, 'doInstall')
|
|
.mockResolvedValue({ version: '0.99.0' });
|
|
|
|
await installer.update();
|
|
|
|
expect(fetchLatest).toHaveBeenCalled();
|
|
expect(doInstall).toHaveBeenCalledWith('0.99.0');
|
|
});
|
|
|
|
it('rejects a resolved version below the supported minimum (real doInstall guard)', async () => {
|
|
const installer = TrivyInstaller.getInstance();
|
|
// Auto-update on so install() takes the fetched-latest path; the fetch returns
|
|
// a sub-minimum version, which the doInstall guard must reject before any
|
|
// download happens. doInstall is NOT mocked here so the real guard runs.
|
|
DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', '1');
|
|
vi.spyOn(installer, 'fetchLatestVersion').mockResolvedValue('0.49.0');
|
|
|
|
await expect(installer.install()).rejects.toThrow(/below minimum/);
|
|
});
|
|
});
|