autonomic-bot
3307bdb0fe
Two refinements found by running the scan across all 14 recipes of the 2026-08-07 run: 1. A repo with no advisory feed returns HTTP 404 on /security-advisories (e.g. the pgautoupgrade sidecar image). That is a BENIGN ABSENCE, not a failed check. Likewise registry entries that are TEMPLATE urls for humans (…/changelog/v<VERSION>/, …/<vX.Y.Z>/…) are documentation, not fetchable. Counting either as a failure pushed most recipes to '?', which would make the unknown-vs-clean distinction meaningless again — the exact signal the ? exists to preserve. Both are now recorded in sources_benign; only genuine errors (rate limit, network, 5xx, wrong URL) land in sources_failed. 2. upstream/*.md pointed at github.com/pgautoupgrade/pgautoupgrade, which 404s — the repo is pgautoupgrade/docker-pgautoupgrade. Corrected in n8n, lasuite-docs, lasuite-drive, lasuite-meet. A 404ing registry URL means we were not scanning a source we believed we were. Effect on the 2026-08-07 data: recipes with genuine failed sources 5 -> 3 (the remainder are really unreachable vendor pages). CVE counts unchanged where they were already sound: discourse 130, gitea 2, plausible 1.
34 lines
2.8 KiB
Markdown
34 lines
2.8 KiB
Markdown
# Upstream sources — lasuite-docs
|
|
|
|
| service | image | source repo | releases / changelog |
|
|
|---------|-------|-------------|----------------------|
|
|
| app | lasuite/impress-frontend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| backend | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| celery | lasuite/impress-backend | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| y-provider | lasuite/impress-y-provider | https://github.com/suitenumerique/docs | https://github.com/suitenumerique/docs/releases |
|
|
| docspec | ghcr.io/docspecio/api | https://github.com/docspecIO/api | https://github.com/docspecIO/api/releases |
|
|
| db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade/releases |
|
|
| redis | redis | https://github.com/redis/redis | https://hub.docker.com/_/redis/tags |
|
|
| minio | minio/minio | https://github.com/minio/minio | https://github.com/minio/minio/releases |
|
|
| web | nginx | https://github.com/nginx/nginx | https://nginx.org/en/CHANGES |
|
|
|
|
## Standing notes
|
|
- impress-frontend, impress-backend (used for both backend + celery services), impress-y-provider all
|
|
share the same version tag from the suitenumerique/docs monorepo. Upgrade all four in lockstep.
|
|
- AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
|
|
- Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades;
|
|
check manually on https://github.com/minio/minio/releases.
|
|
- v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT.
|
|
Both are backward-compatible (no action required for existing deployments).
|
|
- Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.
|
|
- **v5.4.0 removed Bearer/JWT auth on the API** (upstream PR suitenumerique/docs#2480 dropped
|
|
`mozilla_django_oidc.contrib.drf.OIDCAuthentication` from DRF DEFAULT_AUTHENTICATION_CLASSES).
|
|
The API now accepts only the app's session cookie from the real OIDC authorization-code flow.
|
|
Any test/assertion that sends `Authorization: Bearer <jwt>` to `/api/v1.0/*` will get 401 — this is
|
|
the NEW CORRECT behavior, not a regression. The cc-ci lasuite-docs tests were updated for this in
|
|
cc-ci PR #12 (merged 2026-08-03): test_oidc_login.py + test_create_doc.py now use session cookies
|
|
and assert Bearer is rejected. Don't revert to Bearer assertions.
|
|
- redis sidecar (cache/broker for celery+backend): prefer the patch line (8.8.1 over 8.10.0) unless a
|
|
feature is needed — 8.8.1 is a security patch (RedisBloom/TDigest RESTORE RCE); 8.10.0 is a minor
|
|
with many new features.
|