From 55bc449debd522f0d44f2f906a110d324b1fa150 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 11 Sep 2026 08:09:25 +0000 Subject: [PATCH] docs: update CLI and helm reference for v2.40.0 --- client_reference/kosli.md | 2 +- client_reference/kosli_allow_artifact.md | 7 +- .../kosli_archive_attestation-type.md | 2 +- client_reference/kosli_archive_control.md | 2 +- client_reference/kosli_archive_environment.md | 2 +- client_reference/kosli_archive_flow.md | 2 +- client_reference/kosli_assert_artifact.md | 9 +- .../kosli_assert_pullrequest_azure.md | 2 +- .../kosli_assert_pullrequest_bitbucket.md | 2 +- .../kosli_assert_pullrequest_github.md | 2 +- .../kosli_assert_pullrequest_gitlab.md | 2 +- client_reference/kosli_assert_snapshot.md | 2 +- client_reference/kosli_assert_status.md | 2 +- client_reference/kosli_attach-policy.md | 2 +- client_reference/kosli_attest_artifact.md | 11 +- client_reference/kosli_attest_custom.md | 13 +- client_reference/kosli_attest_decision.md | 9 +- client_reference/kosli_attest_generic.md | 13 +- client_reference/kosli_attest_jira.md | 59 +- client_reference/kosli_attest_junit.md | 13 +- .../kosli_attest_pullrequest_azure.md | 9 +- .../kosli_attest_pullrequest_bitbucket.md | 9 +- .../kosli_attest_pullrequest_github.md | 11 +- .../kosli_attest_pullrequest_gitlab.md | 11 +- client_reference/kosli_attest_snyk.md | 9 +- client_reference/kosli_attest_sonar.md | 11 +- client_reference/kosli_begin_trail.md | 8 +- client_reference/kosli_completion.md | 2 +- client_reference/kosli_config.md | 13 +- client_reference/kosli_create_api-key.md | 2 +- .../kosli_create_attestation-type.md | 2 +- client_reference/kosli_create_control.md | 2 +- client_reference/kosli_create_environment.md | 2 +- client_reference/kosli_create_flow.md | 4 +- client_reference/kosli_create_policy.md | 2 +- .../kosli_create_service-account.md | 2 +- client_reference/kosli_delete_api-key.md | 2 +- .../kosli_delete_service-account.md | 2 +- client_reference/kosli_detach-policy.md | 2 +- client_reference/kosli_diff_snapshots.md | 200 +- client_reference/kosli_disable_beta.md | 2 +- client_reference/kosli_enable_beta.md | 2 +- client_reference/kosli_evaluate_input.md | 4 +- client_reference/kosli_evaluate_trail.md | 2 +- client_reference/kosli_evaluate_trails.md | 2 +- client_reference/kosli_fingerprint.md | 9 +- client_reference/kosli_get_api-key.md | 2 +- client_reference/kosli_get_artifact.md | 2 +- .../kosli_get_attestation-type.md | 2 +- client_reference/kosli_get_attestation.md | 4 +- client_reference/kosli_get_control.md | 2 +- client_reference/kosli_get_default-org.md | 2 +- client_reference/kosli_get_environment.md | 8 +- client_reference/kosli_get_flow.md | 2 +- client_reference/kosli_get_policy.md | 2 +- client_reference/kosli_get_repo.md | 2 +- client_reference/kosli_get_service-account.md | 2 +- client_reference/kosli_get_snapshot.md | 4876 ++++++++--------- client_reference/kosli_get_trail.md | 2 +- client_reference/kosli_join_environment.md | 2 +- client_reference/kosli_list_api-keys.md | 2 +- client_reference/kosli_list_artifacts.md | 2 +- .../kosli_list_attestation-types.md | 2 +- client_reference/kosli_list_controls.md | 2 +- client_reference/kosli_list_environments.md | 34 +- client_reference/kosli_list_flows.md | 77 +- client_reference/kosli_list_policies.md | 2 +- client_reference/kosli_list_repos.md | 2 +- .../kosli_list_service-accounts.md | 2 +- client_reference/kosli_list_snapshots.md | 122 +- client_reference/kosli_list_trails.md | 2 +- client_reference/kosli_log_environment.md | 428 +- client_reference/kosli_rename_environment.md | 2 +- client_reference/kosli_rename_flow.md | 2 +- client_reference/kosli_report_artifact.md | 7 +- client_reference/kosli_rotate_api-key.md | 2 +- client_reference/kosli_search.md | 2 +- client_reference/kosli_snapshot_azure.md | 14 +- client_reference/kosli_snapshot_cloud-run.md | 2 +- client_reference/kosli_snapshot_docker.md | 2 +- client_reference/kosli_snapshot_ecs.md | 2 +- client_reference/kosli_snapshot_lambda.md | 2 +- client_reference/kosli_snapshot_path.md | 7 +- client_reference/kosli_snapshot_paths.md | 7 +- client_reference/kosli_snapshot_s3.md | 6 +- client_reference/kosli_snapshot_server.md | 7 +- client_reference/kosli_status.md | 2 +- client_reference/kosli_tag.md | 2 +- client_reference/kosli_unarchive_control.md | 2 +- client_reference/kosli_update_control.md | 2 +- client_reference/kosli_update_default-org.md | 2 +- .../kosli_update_service-account.md | 2 +- client_reference/kosli_version.md | 2 +- client_reference/overview.md | 2 +- 94 files changed, 3167 insertions(+), 2984 deletions(-) diff --git a/client_reference/kosli.md b/client_reference/kosli.md index 971de10d..877c1e11 100644 --- a/client_reference/kosli.md +++ b/client_reference/kosli.md @@ -18,7 +18,7 @@ Setting the API token to DRY_RUN sets the --dry-run flag. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-h`, `--help` | bool | help for kosli | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | diff --git a/client_reference/kosli_allow_artifact.md b/client_reference/kosli_allow_artifact.md index f9450511..aa0b7a4a 100644 --- a/client_reference/kosli_allow_artifact.md +++ b/client_reference/kosli_allow_artifact.md @@ -38,7 +38,10 @@ is set), registry credentials are resolved as follows: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -59,7 +62,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_archive_attestation-type.md b/client_reference/kosli_archive_attestation-type.md index fa864198..f28c2c94 100644 --- a/client_reference/kosli_archive_attestation-type.md +++ b/client_reference/kosli_archive_attestation-type.md @@ -24,7 +24,7 @@ New custom attestations using this type cannot be made, but existing attestation | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_archive_control.md b/client_reference/kosli_archive_control.md index df7bac8e..bb865df3 100644 --- a/client_reference/kosli_archive_control.md +++ b/client_reference/kosli_archive_control.md @@ -30,7 +30,7 @@ via `kosli list controls --archived`, and can be restored with `kosli unarchive | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_archive_environment.md b/client_reference/kosli_archive_environment.md index 86f134a9..b86e4ca6 100644 --- a/client_reference/kosli_archive_environment.md +++ b/client_reference/kosli_archive_environment.md @@ -24,7 +24,7 @@ The environment will no longer be visible in list of environments, data is still | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_archive_flow.md b/client_reference/kosli_archive_flow.md index 7440c566..69e2b7bb 100644 --- a/client_reference/kosli_archive_flow.md +++ b/client_reference/kosli_archive_flow.md @@ -24,7 +24,7 @@ The flow will no longer be visible in list of flows, data is still stored in the | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_assert_artifact.md b/client_reference/kosli_assert_artifact.md index 6a5c9484..0064f6f1 100644 --- a/client_reference/kosli_assert_artifact.md +++ b/client_reference/kosli_assert_artifact.md @@ -35,7 +35,10 @@ non-zero code if non-compliant status. To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -58,7 +61,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -73,7 +76,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, View an example of the `kosli assert artifact` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L271) + In [this YAML file](https://github.com/cyber-dojo/differ/blob/06dc33ad1a46960bd685d00be993098a74a6dca0/.github/workflows/main.yml#L274) View an example of the `kosli assert artifact` command in GitLab. diff --git a/client_reference/kosli_assert_pullrequest_azure.md b/client_reference/kosli_assert_pullrequest_azure.md index 67c55f15..2f67c00e 100644 --- a/client_reference/kosli_assert_pullrequest_azure.md +++ b/client_reference/kosli_assert_pullrequest_azure.md @@ -29,7 +29,7 @@ if no pull requests were found for the commit. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_assert_pullrequest_bitbucket.md b/client_reference/kosli_assert_pullrequest_bitbucket.md index 61184c4e..404c8ab8 100644 --- a/client_reference/kosli_assert_pullrequest_bitbucket.md +++ b/client_reference/kosli_assert_pullrequest_bitbucket.md @@ -31,7 +31,7 @@ Bitbucket app passwords are no longer supported as of 28 July 2026; replace any | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_assert_pullrequest_github.md b/client_reference/kosli_assert_pullrequest_github.md index 0f36f001..f59f86db 100644 --- a/client_reference/kosli_assert_pullrequest_github.md +++ b/client_reference/kosli_assert_pullrequest_github.md @@ -29,7 +29,7 @@ if no pull requests were found for the commit. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_assert_pullrequest_gitlab.md b/client_reference/kosli_assert_pullrequest_gitlab.md index ce89acee..d5f21ab6 100644 --- a/client_reference/kosli_assert_pullrequest_gitlab.md +++ b/client_reference/kosli_assert_pullrequest_gitlab.md @@ -29,7 +29,7 @@ if no merge requests were found for the commit. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_assert_snapshot.md b/client_reference/kosli_assert_snapshot.md index d10ca0fe..21bd3d4b 100644 --- a/client_reference/kosli_assert_snapshot.md +++ b/client_reference/kosli_assert_snapshot.md @@ -35,7 +35,7 @@ Examples of valid expressions are: | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_assert_status.md b/client_reference/kosli_assert_status.md index 5e37336c..a21c30a9 100644 --- a/client_reference/kosli_assert_status.md +++ b/client_reference/kosli_assert_status.md @@ -22,7 +22,7 @@ Exits with non-zero code if the Kosli server down. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_attach-policy.md b/client_reference/kosli_attach-policy.md index d7a485a3..2bfba312 100644 --- a/client_reference/kosli_attach-policy.md +++ b/client_reference/kosli_attach-policy.md @@ -23,7 +23,7 @@ Attach a policy to one or more Kosli environments. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_attest_artifact.md b/client_reference/kosli_attest_artifact.md index 0640cbef..9572adb7 100644 --- a/client_reference/kosli_attest_artifact.md +++ b/client_reference/kosli_attest_artifact.md @@ -38,7 +38,10 @@ is set), registry credentials are resolved as follows: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. This command requires access to a git repo to associate the artifact to the git commit it is originating from. You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. To record repository information, all three of `--repo-id`, `--repo-url`, and `--repository` must be set together. @@ -78,7 +81,7 @@ In other CI systems, set them explicitly to capture repository metadata. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -93,12 +96,12 @@ In other CI systems, set them explicitly to capture repository metadata. View an example of the `kosli attest artifact` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/reusable-actions-workflows/blob/25f0b797c18403de1c8490a9a71bbe9789c809a9/.github/workflows/secure-docker-build.yml#L210), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=11345222-f37a-4f8d-8051-ec26a321). + In [this YAML file](https://github.com/cyber-dojo/reusable-actions-workflows/blob/25f0b797c18403de1c8490a9a71bbe9789c809a9/.github/workflows/secure-docker-build.yml#L210), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/2e9bd969b50fff6b86578d69b7139f2d688ef6e2?attestation_id=054eef05-3aee-49ae-9e4d-55f768b7). View an example of the `kosli attest artifact` command in GitLab. - In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L111), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=61384b36-4d32-43f2-8d5d-a72e2e7e). + In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L111), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/99d7b74f39e311d492902ad48dbe97da63f2c687?attestation_id=205424b6-5741-4071-bd36-c26e83f6). diff --git a/client_reference/kosli_attest_custom.md b/client_reference/kosli_attest_custom.md index 1887107a..3c18e319 100644 --- a/client_reference/kosli_attest_custom.md +++ b/client_reference/kosli_attest_custom.md @@ -21,7 +21,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo). You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. @@ -37,7 +40,7 @@ In other CI systems, set them explicitly to capture repository metadata. | `--annotate` | stringToString | [optional] Annotate the attestation with data using key=value. | | `-t`, `--artifact-type` | string | The type of the artifact to calculate its SHA256 fingerprint. One of: [oci, docker, file, dir]. Only required if you want Kosli to calculate the fingerprint for you (i.e. when you don't specify '`--fingerprint`' on commands that allow it). | | `--attachments` | strings | [optional] The comma-separated list of paths of attachments for the reported attestation. Attachments can be files or directories. All attachments are compressed and uploaded to Kosli's evidence vault. | -| `--attestation-data` | string | The filepath of a json file containing the custom attestation data. | +| `--attestation-data` | string | The filepath of a JSON file containing the custom attestation data. The maximum JSON payload size is 1MB. | | `-g`, `--commit` | string | [conditional] The git commit for which the attestation is associated to. Becomes required when reporting an attestation for an artifact before reporting it to Kosli. (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--description` | string | [optional] attestation description | | `-D`, `--dry-run` | bool | [optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. | @@ -60,14 +63,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | | `--type` | string | The name of the custom attestation type. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -82,7 +85,7 @@ In other CI systems, set them explicitly to capture repository metadata. View an example of the `kosli attest custom` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L168), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=8dfb2b55-0e6d-4d76-8396-4c85e9aa). + In [this YAML file](https://github.com/cyber-dojo/differ/blob/2e9bd969b50fff6b86578d69b7139f2d688ef6e2/.github/workflows/main.yml#L168), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/2e9bd969b50fff6b86578d69b7139f2d688ef6e2?attestation_id=46b51e1e-c0db-463e-b8d0-63dd8d20). diff --git a/client_reference/kosli_attest_decision.md b/client_reference/kosli_attest_decision.md index 72773017..f3fbf75d 100644 --- a/client_reference/kosli_attest_decision.md +++ b/client_reference/kosli_attest_decision.md @@ -27,7 +27,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo). You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. @@ -66,14 +69,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_attest_generic.md b/client_reference/kosli_attest_generic.md index 61703295..574afd3f 100644 --- a/client_reference/kosli_attest_generic.md +++ b/client_reference/kosli_attest_generic.md @@ -18,7 +18,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo). You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. @@ -56,14 +59,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -78,12 +81,12 @@ In other CI systems, set them explicitly to capture repository metadata. View an example of the `kosli attest generic` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/dashboard/blob/ff9f292e809801d35246183988b7812826bc2760/.github/workflows/main.yml#L198), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/ff9f292e809801d35246183988b7812826bc2760?attestation_id=dcf20aee-975c-4b20-9d25-02c789f8). + In [this YAML file](https://github.com/cyber-dojo/dashboard/blob/6b20a423d5ce05139d4480e9ce67f40e3eda2e07/.github/workflows/main.yml#L198), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/6b20a423d5ce05139d4480e9ce67f40e3eda2e07?attestation_id=907e3880-bd6b-437c-93ec-5c06d7b7). View an example of the `kosli attest generic` command in GitLab. - In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L131), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=b72fe1fe-90da-4738-a506-d803f5a6). + In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L131), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/99d7b74f39e311d492902ad48dbe97da63f2c687?attestation_id=9c8259bd-ae21-40ad-9907-c5b94498). diff --git a/client_reference/kosli_attest_jira.md b/client_reference/kosli_attest_jira.md index b38f2b4c..792ce5f1 100644 --- a/client_reference/kosli_attest_jira.md +++ b/client_reference/kosli_attest_jira.md @@ -10,8 +10,15 @@ kosli attest jira [IMAGE-NAME | FILE-PATH | DIR-PATH] [flags] ``` Report a jira attestation to an artifact or a trail in a Kosli flow. -Parses the given commit's message, current branch name or the content of the `--jira-secondary-source` -argument for Jira issue references of the form: +By default, parses the given commit's message, current branch name, or the content of the +`--jira-secondary-source` argument for Jira issue references. +Use `--jira-trailer` to read issue keys exclusively from a named git trailer line instead +(e.g. `Jira: PROJ-42`); only the last block of lines in the commit message is scanned +(everything after the final blank line, or the whole message if there is no blank line). +The rest of the commit message and branch name are not scanned. +`--jira-trailer` and `--jira-secondary-source` are mutually exclusive. + +Jira issue references have the form: 'at least 2 characters long, starting with an uppercase letter project key followed by dash and one or more digits'. @@ -31,13 +38,19 @@ because `CVE-2026` would be followed by `-4`. This applies across all parsed sou (commit message, branch name, and secondary source). Note: if your Jira project key collides with this pattern (e.g. a project key of `CVE`), an issue reference that happens to be the prefix of a longer hyphenated number (such as a CVE -identifier) will be filtered out. Use `--jira-secondary-source` with a different identifier -format as a workaround. +identifier) will be filtered out. Use `--jira-trailer` to read issue keys from a dedicated +git trailer line (e.g. `Jira: CVE-42`), which confines scanning to the trailer value and +removes collisions caused by surrounding commit text; write the issue key alone in the +trailer value, not embedded in a longer hyphenated string (e.g. `Jira: CVE-2026-41284` +would still be filtered out). Alternatively, use `--jira-secondary-source` with a different +identifier format. If you want to restrict the Jira issue matching to a specific project, use the `--jira-project-key` flag to specify your own project key. You can specify multiple project keys if needed. If the `--ignore-branch-match` is set, the branch name is not parsed for a match. +`--ignore-branch-match` has no effect when `--jira-trailer` is set, since the branch is +never scanned in trailer mode. The found issue references will be checked against Jira to confirm their existence. The attestation is reported in all cases, and its compliance status depends on referencing @@ -62,7 +75,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo). You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. @@ -94,7 +110,8 @@ In other CI systems, set them explicitly to capture repository metadata. | `--jira-issue-fields` | string | [optional] The comma separated list of fields to include from the Jira issue. Default no fields are included. '*all' will give all fields. | | `--jira-pat` | string | Jira personal access token (for self-hosted Jira) | | `--jira-project-key` | strings | [optional] Jira project key to match against. Can be repeated, or given as a comma-separated list. Defaults to matching any jira project key. | -| `--jira-secondary-source` | string | [optional] An optional string to search for Jira ticket reference, e.g. '`--jira-secondary-source` $\{\{ github.head_ref \}\}' | +| `--jira-secondary-source` | string | [optional] An optional string to search for Jira ticket reference, e.g. '`--jira-secondary-source` $\{\{ github.head_ref \}\}'. Mutually exclusive with `--jira-trailer`. | +| `--jira-trailer` | string | [optional] The git trailer key to use as the sole source of Jira issue references (e.g. '`--jira-trailer` Jira' extracts the value of 'Jira: `issue-key`' lines from the final paragraph of the commit message). When set, the rest of the commit message and branch name are not scanned. Mutually exclusive with `--jira-secondary-source`. | | `--jira-username` | string | Jira username (for Jira Cloud) | | `-n`, `--name` | string | The name of the attestation as declared in the flow or trail yaml template. | | `-o`, `--origin-url` | string | [optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ). | @@ -108,14 +125,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -224,6 +241,32 @@ kosli attest jira --jira-base-url https://kosli.atlassian.net --jira-username user@domain.com --jira-api-token yourJiraAPIToken + +``` + + +```shell + +``` + + +```shell + +``` + + +```shell + +``` + + +```shell +kosli attest jira + --name yourAttestationName + --jira-trailer Jira + --jira-base-url https://kosli.atlassian.net + --jira-username user@domain.com + --jira-api-token yourJiraAPIToken ``` diff --git a/client_reference/kosli_attest_junit.md b/client_reference/kosli_attest_junit.md index 70aa78c4..04e5fcbb 100644 --- a/client_reference/kosli_attest_junit.md +++ b/client_reference/kosli_attest_junit.md @@ -22,7 +22,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo). You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. @@ -61,14 +64,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `-R`, `--results-dir` | string | [defaulted] The path to a directory with JUnit test results. By default, the directory will be uploaded to Kosli's evidence vault. (default ".") | | `-T`, `--trail` | string | The Kosli trail name. | | `--upload-results` | bool | [defaulted] Whether to upload the provided Junit results directory as an attachment to Kosli or not. (default true) | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -83,12 +86,12 @@ In other CI systems, set them explicitly to capture repository metadata. View an example of the `kosli attest junit` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L101), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=1143f5cc-9e0e-4bbc-a6bd-be16b348). + In [this YAML file](https://github.com/cyber-dojo/differ/blob/2e9bd969b50fff6b86578d69b7139f2d688ef6e2/.github/workflows/main.yml#L101), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/2e9bd969b50fff6b86578d69b7139f2d688ef6e2?attestation_id=e6d4ca97-543f-43e2-85c5-24013053). View an example of the `kosli attest junit` command in GitLab. - In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L126), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=bea54670-c4f5-4e14-93b1-e234c111). + In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L126), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/99d7b74f39e311d492902ad48dbe97da63f2c687?attestation_id=5401706d-eaca-41ff-a481-7fc8a1b8). diff --git a/client_reference/kosli_attest_pullrequest_azure.md b/client_reference/kosli_attest_pullrequest_azure.md index 0bf06285..bdce727e 100644 --- a/client_reference/kosli_attest_pullrequest_azure.md +++ b/client_reference/kosli_attest_pullrequest_azure.md @@ -20,7 +20,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -53,14 +56,14 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_attest_pullrequest_bitbucket.md b/client_reference/kosli_attest_pullrequest_bitbucket.md index fcc7b0aa..de143b5f 100644 --- a/client_reference/kosli_attest_pullrequest_bitbucket.md +++ b/client_reference/kosli_attest_pullrequest_bitbucket.md @@ -22,7 +22,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -56,14 +59,14 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_attest_pullrequest_github.md b/client_reference/kosli_attest_pullrequest_github.md index 877869c7..caeccd50 100644 --- a/client_reference/kosli_attest_pullrequest_github.md +++ b/client_reference/kosli_attest_pullrequest_github.md @@ -20,7 +20,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -53,14 +56,14 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -75,7 +78,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, View an example of the `kosli attest pullrequest github` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/differ/blob/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de/.github/workflows/main.yml#L81), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de?attestation_id=7cf44301-0ca2-4b1f-9ce2-6f17ee0d). + In [this YAML file](https://github.com/cyber-dojo/differ/blob/2e9bd969b50fff6b86578d69b7139f2d688ef6e2/.github/workflows/main.yml#L81), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/2e9bd969b50fff6b86578d69b7139f2d688ef6e2?attestation_id=4074789c-67a2-4c79-ac47-e98c308b). diff --git a/client_reference/kosli_attest_pullrequest_gitlab.md b/client_reference/kosli_attest_pullrequest_gitlab.md index d4845f34..c4f1618a 100644 --- a/client_reference/kosli_attest_pullrequest_gitlab.md +++ b/client_reference/kosli_attest_pullrequest_gitlab.md @@ -20,7 +20,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -53,14 +56,14 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -75,7 +78,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, View an example of the `kosli attest pullrequest gitlab` command in GitLab. - In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L75), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=c02a9fb9-70fd-44e8-80f0-ec85ea83). + In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L75), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/99d7b74f39e311d492902ad48dbe97da63f2c687?attestation_id=a70287f4-c9fa-4072-9221-34faa89d). diff --git a/client_reference/kosli_attest_snyk.md b/client_reference/kosli_attest_snyk.md index d04247e5..1b618812 100644 --- a/client_reference/kosli_attest_snyk.md +++ b/client_reference/kosli_attest_snyk.md @@ -26,7 +26,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. You can optionally associate the attestation to a git commit using `--commit` (requires access to a git repo). You can optionally redact some of the git commit data sent to Kosli using `--redact-commit-info`. @@ -65,14 +68,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `-R`, `--scan-results` | string | The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault. | | `-T`, `--trail` | string | The Kosli trail name. | | `--upload-results` | bool | [defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not. (default true) | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_attest_sonar.md b/client_reference/kosli_attest_sonar.md index f997c9a7..be11c650 100644 --- a/client_reference/kosli_attest_sonar.md +++ b/client_reference/kosli_attest_sonar.md @@ -46,7 +46,10 @@ The attestation can be bound to an *artifact* in two ways: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -84,14 +87,14 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | `--sonar-server-url` | string | [conditional] The URL of your SonarQube server. Only required if you are using SonarQube Server and not using SonarQube's metadata file to get scan results. (default "https://sonarcloud.io") | | `--sonar-working-dir` | string | [conditional] The base directory of the repo scanned by SonarQube. Only required if you have overridden the default in the Sonar scanner or you are running the CLI locally in a separate folder from the repo. (default ".scannerwork") | | `-T`, `--trail` | string | The Kosli trail name. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -106,7 +109,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, View an example of the `kosli attest sonar` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/dashboard/blob/ff9f292e809801d35246183988b7812826bc2760/.github/workflows/main.yml#L123), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/ff9f292e809801d35246183988b7812826bc2760?attestation_id=6d693383-c6de-4551-8a29-1025803a). + In [this YAML file](https://github.com/cyber-dojo/dashboard/blob/6b20a423d5ce05139d4480e9ce67f40e3eda2e07/.github/workflows/main.yml#L123), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/dashboard-ci/trails/6b20a423d5ce05139d4480e9ce67f40e3eda2e07?attestation_id=484f07e3-f170-4790-9b2e-0c5b6688). diff --git a/client_reference/kosli_begin_trail.md b/client_reference/kosli_begin_trail.md index 507ad3c4..157c64fe 100644 --- a/client_reference/kosli_begin_trail.md +++ b/client_reference/kosli_begin_trail.md @@ -38,14 +38,14 @@ In other CI systems, set them explicitly to capture repository metadata. | `--repo-url` | string | [conditional] The URL of the repository. Must be a valid URL. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `--repository` | string | [conditional] The name of the repository (e.g. owner/repo-name). All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ). | | `-f`, `--template-file` | string | [optional] The path to a yaml template file. | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the flow trail. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the flow trail. The maximum JSON payload size is 1MB. | ## Flags inherited from parent commands | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -60,12 +60,12 @@ In other CI systems, set them explicitly to capture repository metadata. View an example of the `kosli begin trail` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/runner/blob/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9/.github/workflows/main.yml#L78), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/runner-ci/trails/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9?attestation_id=1). + In [this YAML file](https://github.com/cyber-dojo/runner/blob/4b2bfc038576e2a7648090c4c1289fbc9ebfc481/.github/workflows/main.yml#L78), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/runner-ci/trails/4b2bfc038576e2a7648090c4c1289fbc9ebfc481?attestation_id=1). View an example of the `kosli begin trail` command in GitLab. - In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L55), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/d64d2b11879179255f11dc991e81fbaf4a040264?attestation_id=1). + In [this YAML file](https://gitlab.com/cyber-dojo/creator/-/blob/65fd2bfa2478534ea4bc5ccf30f6bfc6aab7550c/.gitlab/workflows/main.yml#L55), which created [this Kosli Event](https://app.kosli.com/cyber-dojo/flows/creator-ci/trails/99d7b74f39e311d492902ad48dbe97da63f2c687?attestation_id=1). diff --git a/client_reference/kosli_completion.md b/client_reference/kosli_completion.md index b66eadcf..4715e085 100644 --- a/client_reference/kosli_completion.md +++ b/client_reference/kosli_completion.md @@ -68,7 +68,7 @@ you will need to enable it. You can execute the following once: | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_config.md b/client_reference/kosli_config.md index 5fe439bb..2a6fd0c4 100644 --- a/client_reference/kosli_config.md +++ b/client_reference/kosli_config.md @@ -1,6 +1,6 @@ --- title: "kosli config" -description: "Config global Kosli flags values and store them in $HOME/.kosli . " +description: "Config global Kosli flags values and store them in $HOME/.kosli.yml . " --- ## Synopsis @@ -9,13 +9,16 @@ description: "Config global Kosli flags values and store them in $HOME/.kosli . kosli config [flags] ``` -Config global Kosli flags values and store them in $HOME/.kosli . +Config global Kosli flags values and store them in $HOME/.kosli.yml . Flag values are determined in the following order (highest precedence first): - command line flags on each executed command. - environment variables. -- custom config file provided with --config-file flag. -- default config file in $HOME/.kosli +- custom config file provided with the --config-file flag or the KOSLI_CONFIG_FILE env var. +- default config file in $HOME/.kosli.yml + +A config file in the directory a command runs from is never read unless it is named +with --config-file or KOSLI_CONFIG_FILE. You can configure global Kosli flags (the ones that apply to all/most commands) using their dedicated convenience flags (e.g. --org). @@ -38,7 +41,7 @@ Keys correspond to the specific flag name, capitalized. For instance: --flow wou | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_create_api-key.md b/client_reference/kosli_create_api-key.md index e99aad1b..6a19f191 100644 --- a/client_reference/kosli_create_api-key.md +++ b/client_reference/kosli_create_api-key.md @@ -28,7 +28,7 @@ The key value is only returned once, at creation time, so make sure to store it | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_create_attestation-type.md b/client_reference/kosli_create_attestation-type.md index 59b3155a..a41bd85e 100644 --- a/client_reference/kosli_create_attestation-type.md +++ b/client_reference/kosli_create_attestation-type.md @@ -54,7 +54,7 @@ Attestation types created without a summary fall back to the `jq` evaluation rul | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_create_control.md b/client_reference/kosli_create_control.md index e5004905..2f2ccac9 100644 --- a/client_reference/kosli_create_control.md +++ b/client_reference/kosli_create_control.md @@ -32,7 +32,7 @@ Create a Kosli control. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_create_environment.md b/client_reference/kosli_create_environment.md index 8ee8b2d6..996d657d 100644 --- a/client_reference/kosli_create_environment.md +++ b/client_reference/kosli_create_environment.md @@ -46,7 +46,7 @@ to them. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_create_flow.md b/client_reference/kosli_create_flow.md index 6c295a17..15671fb4 100644 --- a/client_reference/kosli_create_flow.md +++ b/client_reference/kosli_create_flow.md @@ -31,7 +31,7 @@ You can specify flow parameters in flags. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -46,7 +46,7 @@ You can specify flow parameters in flags. View an example of the `kosli create flow` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/runner/blob/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9/.github/workflows/main.yml#L62) + In [this YAML file](https://github.com/cyber-dojo/runner/blob/4b2bfc038576e2a7648090c4c1289fbc9ebfc481/.github/workflows/main.yml#L62) View an example of the `kosli create flow` command in GitLab. diff --git a/client_reference/kosli_create_policy.md b/client_reference/kosli_create_policy.md index 4d4244c2..6b05125d 100644 --- a/client_reference/kosli_create_policy.md +++ b/client_reference/kosli_create_policy.md @@ -25,7 +25,7 @@ Updating policy content creates a new version of the policy. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_create_service-account.md b/client_reference/kosli_create_service-account.md index c1ec1ce3..54652ab1 100644 --- a/client_reference/kosli_create_service-account.md +++ b/client_reference/kosli_create_service-account.md @@ -27,7 +27,7 @@ created separately for it with `kosli create api-key`. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_delete_api-key.md b/client_reference/kosli_delete_api-key.md index 995a5a86..f1d04196 100644 --- a/client_reference/kosli_delete_api-key.md +++ b/client_reference/kosli_delete_api-key.md @@ -31,7 +31,7 @@ command fails without deleting anything, so pass `--assume-yes` there. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_delete_service-account.md b/client_reference/kosli_delete_service-account.md index 266a3a4e..102f4ea9 100644 --- a/client_reference/kosli_delete_service-account.md +++ b/client_reference/kosli_delete_service-account.md @@ -31,7 +31,7 @@ command fails without deleting anything, so pass `--assume-yes` there. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_detach-policy.md b/client_reference/kosli_detach-policy.md index 81aa62e0..f3f04c95 100644 --- a/client_reference/kosli_detach-policy.md +++ b/client_reference/kosli_detach-policy.md @@ -23,7 +23,7 @@ If the environment has no more policies attached to it, then its snapshots' stat | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_diff_snapshots.md b/client_reference/kosli_diff_snapshots.md index e1da6ae1..548d82be 100644 --- a/client_reference/kosli_diff_snapshots.md +++ b/client_reference/kosli_diff_snapshots.md @@ -40,7 +40,7 @@ Specify SNAPPISH_1 and SNAPPISH_2 by: | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -66,104 +66,178 @@ kosli diff snapshots aws-beta aws-prod --output=json ```json { "snappish1": { - "snapshot_id": "aws-beta#8249", - "artifacts": [] - }, - "snappish2": { - "snapshot_id": "aws-prod#5309", - "artifacts": [] - }, - "changed": { - "artifacts": [] - }, - "not-changed": { + "snapshot_id": "aws-beta#8350", "artifacts": [ { - "fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "most_recent_timestamp": 1788255749, - "flow": "differ-ci", - "commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "fingerprint": "1d819a21e793bffbe50a39c9b6b8c4154e0b4271051931839dc8a2fa0c564e2a", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:2e1a942@sha256:1d819a21e793bffbe50a39c9b6b8c4154e0b4271051931839dc8a2fa0c564e2a", + "most_recent_timestamp": 1788966072, + "flow": "nginx-ci", + "commit_url": "https://github.com/cyber-dojo/nginx/commit/2e1a942c3d17cae29db3bc94336f06773e3573c3", "instance_count": 1 }, { - "fingerprint": "06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:84e986a@sha256:06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "most_recent_timestamp": 1788255396, + "fingerprint": "1ff25328272b6a1c85d6751e326b2d941cf927a040a41e2e3cb96b606b01709f", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:c61d934@sha256:1ff25328272b6a1c85d6751e326b2d941cf927a040a41e2e3cb96b606b01709f", + "most_recent_timestamp": 1788966002, + "flow": "exercises-start-points-ci", + "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/c61d9342b4008c664ffdabaf851538ede9085b76", + "instance_count": 1 + }, + { + "fingerprint": "7a8cbbe05f8659a3ad37e537756c313dcb10e25e49ed1a1c9a656bde472ce887", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:75d91ed@sha256:7a8cbbe05f8659a3ad37e537756c313dcb10e25e49ed1a1c9a656bde472ce887", + "most_recent_timestamp": 1788966515, + "flow": "web-ci", + "commit_url": "https://github.com/cyber-dojo/web/commit/75d91edd753298bf7e4f9b07ae20ba16707dea5f", + "instance_count": 3 + }, + { + "fingerprint": "7b246678863435a956925627616acd8969d0f23b3b9f3db375e7ed0f68e3373a", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:de3178a@sha256:7b246678863435a956925627616acd8969d0f23b3b9f3db375e7ed0f68e3373a", + "most_recent_timestamp": 1788966207, "flow": "saver-ci", - "commit_url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "commit_url": "https://github.com/cyber-dojo/saver/commit/de3178a3d647276644a0dde662af8a53005c97d2", "instance_count": 1 }, { - "fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "most_recent_timestamp": 1788255750, - "flow": "nginx-ci", - "commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "fingerprint": "b250b0603dd70628fdf46ff1e73cb29491febf5f4e127728f2a2e4a7aad2ee02", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:8c3bffd@sha256:b250b0603dd70628fdf46ff1e73cb29491febf5f4e127728f2a2e4a7aad2ee02", + "most_recent_timestamp": 1788965787, + "flow": "custom-start-points-ci", + "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/8c3bffd55590a7d6c180980b263117096a9add32", "instance_count": 1 }, { - "fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "most_recent_timestamp": 1788255387, - "flow": "dashboard-ci", - "commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760", + "fingerprint": "ba00a3efafbea83322e018ae78fd97defd8f018c794a135859dcc02a7e70bd5c", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:da21200@sha256:ba00a3efafbea83322e018ae78fd97defd8f018c794a135859dcc02a7e70bd5c", + "most_recent_timestamp": 1789113338, + "flow": "languages-start-points-ci", + "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/da2120004a066092cc36c0f8d20f5186106b3d04", + "instance_count": 1 + }, + { + "fingerprint": "ba63a80521117f0778ca0e2f564fffba0926292eeeaf0a9e1103952fafbec472", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:a339a8f@sha256:ba63a80521117f0778ca0e2f564fffba0926292eeeaf0a9e1103952fafbec472", + "most_recent_timestamp": 1788965009, + "flow": "spooler-ci", + "commit_url": "https://github.com/cyber-dojo/spooler/commit/a339a8f19075445057a1466a44ca241f093384e4", "instance_count": 1 }, { - "fingerprint": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "most_recent_timestamp": 1788255750, + "fingerprint": "dbd68f81c38a9bdbccac20e2ca5c23c6377a7093b0c7e5730156431eb06d64cf", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:06dc33a@sha256:dbd68f81c38a9bdbccac20e2ca5c23c6377a7093b0c7e5730156431eb06d64cf", + "most_recent_timestamp": 1788979049, + "flow": "differ-ci", + "commit_url": "https://github.com/cyber-dojo/differ/commit/06dc33ad1a46960bd685d00be993098a74a6dca0", + "instance_count": 1 + }, + { + "fingerprint": "e5197f0eda74fc1a6311f8745ef9d8eecefcbf3e75eb1179dc1c1c44075608ae", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:1e3d084@sha256:e5197f0eda74fc1a6311f8745ef9d8eecefcbf3e75eb1179dc1c1c44075608ae", + "most_recent_timestamp": 1788966462, + "flow": "dashboard-ci", + "commit_url": "https://github.com/cyber-dojo/dashboard/commit/1e3d084c20f92afd8747d3d1f70c00b30d07c5fe", + "instance_count": 1 + } + ] + }, + "snappish2": { + "snapshot_id": "aws-prod#5352", + "artifacts": [ + { + "fingerprint": "040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:5d1d4b6@sha256:040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "most_recent_timestamp": 1789022826, "flow": "languages-start-points-ci", - "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9", + "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/5d1d4b6035691d7986e05ab263e521b3e711fa0c", "instance_count": 1 }, { - "fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "most_recent_timestamp": 1788255398, - "flow": "custom-start-points-ci", - "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "fingerprint": "4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:6b20a42@sha256:4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "most_recent_timestamp": 1789022830, + "flow": "dashboard-ci", + "commit_url": "https://github.com/cyber-dojo/dashboard/commit/6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "instance_count": 1 }, { - "fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "most_recent_timestamp": 1788074889, - "flow": "web-ci", - "commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334", - "instance_count": 3 + "fingerprint": "9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:7c4708f@sha256:9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "most_recent_timestamp": 1789022816, + "flow": "saver-ci", + "commit_url": "https://github.com/cyber-dojo/saver/commit/7c4708f675a7717376529273ec32d08cd93f5c26", + "instance_count": 1 + }, + { + "fingerprint": "9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:5e4740c@sha256:9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "most_recent_timestamp": 1789022819, + "flow": "spooler-ci", + "commit_url": "https://github.com/cyber-dojo/spooler/commit/5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "instance_count": 1 + }, + { + "fingerprint": "aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:bd3938c@sha256:aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "most_recent_timestamp": 1789022826, + "flow": "nginx-ci", + "commit_url": "https://github.com/cyber-dojo/nginx/commit/bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "instance_count": 1 }, { - "fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "most_recent_timestamp": 1788255396, + "fingerprint": "bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:d01bb39@sha256:bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "most_recent_timestamp": 1789022822, "flow": "exercises-start-points-ci", - "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/d01bb39495a1356eabe934bef84b92cc964a26f1", "instance_count": 1 }, { - "fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "most_recent_timestamp": 1788255396, - "flow": "spooler-ci", - "commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "fingerprint": "e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:236898f@sha256:e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "most_recent_timestamp": 1789022884, + "flow": "web-ci", + "commit_url": "https://github.com/cyber-dojo/web/commit/236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "instance_count": 3 + }, + { + "fingerprint": "ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:86c839e@sha256:ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "most_recent_timestamp": 1789022818, + "flow": "custom-start-points-ci", + "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/86c839ee588f393d84a6b9c036478d10bb6f2a2d", "instance_count": 1 }, { - "fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "most_recent_timestamp": 1788255844, + "fingerprint": "f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:2e9bd96@sha256:f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "most_recent_timestamp": 1789022811, + "flow": "differ-ci", + "commit_url": "https://github.com/cyber-dojo/differ/commit/2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "instance_count": 1 + } + ] + }, + "changed": { + "artifacts": [] + }, + "not-changed": { + "artifacts": [ + { + "fingerprint": "8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:4b2bfc0@sha256:8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "most_recent_timestamp": 1789022877, "flow": "runner-ci", - "commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "commit_url": "https://github.com/cyber-dojo/runner/commit/4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "instance_count": 3 }, { - "fingerprint": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "most_recent_timestamp": 1788256052, + "fingerprint": "a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:99d7b74@sha256:a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "most_recent_timestamp": 1789023319, "flow": "creator-ci", - "commit_url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264", + "commit_url": "https://github.com/cyber-dojo/creator/commit/99d7b74f39e311d492902ad48dbe97da63f2c687", "instance_count": 1 } ] diff --git a/client_reference/kosli_disable_beta.md b/client_reference/kosli_disable_beta.md index 238fc3bd..6399d60a 100644 --- a/client_reference/kosli_disable_beta.md +++ b/client_reference/kosli_disable_beta.md @@ -21,7 +21,7 @@ Disable beta features for an organization. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_enable_beta.md b/client_reference/kosli_enable_beta.md index 7e22a4c2..fe7a401b 100644 --- a/client_reference/kosli_enable_beta.md +++ b/client_reference/kosli_enable_beta.md @@ -21,7 +21,7 @@ Enable beta features for an organization. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_evaluate_input.md b/client_reference/kosli_evaluate_input.md index e7c0bf65..4f0bbc69 100644 --- a/client_reference/kosli_evaluate_input.md +++ b/client_reference/kosli_evaluate_input.md @@ -49,7 +49,7 @@ This accepts inline JSON or a file reference (`@file.json`). | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -64,7 +64,7 @@ This accepts inline JSON or a file reference (`@file.json`). View an example of the `kosli evaluate input` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/ed3c81d7322bb8058615095f4aab28c147c53933/tests/test_rego_rules.sh#L286) + In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/30111f180ac4e3611cdbd7d805381a0bb9f53cff/tests/test_rego_rules.sh#L304) diff --git a/client_reference/kosli_evaluate_trail.md b/client_reference/kosli_evaluate_trail.md index 6f339e12..bb57fc6b 100644 --- a/client_reference/kosli_evaluate_trail.md +++ b/client_reference/kosli_evaluate_trail.md @@ -40,7 +40,7 @@ full data structure available to the policy. Use `--output json` for structured | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_evaluate_trails.md b/client_reference/kosli_evaluate_trails.md index 317a8109..cf5d4245 100644 --- a/client_reference/kosli_evaluate_trails.md +++ b/client_reference/kosli_evaluate_trails.md @@ -41,7 +41,7 @@ full data structure available to the policy. Use `--output json` for structured | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_fingerprint.md b/client_reference/kosli_fingerprint.md index afb34dbb..109e7411 100644 --- a/client_reference/kosli_fingerprint.md +++ b/client_reference/kosli_fingerprint.md @@ -46,7 +46,10 @@ If the directory structure contains a symbolic link to a *directory* (for exampl To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -64,7 +67,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -79,7 +82,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, View an example of the `kosli fingerprint` command in GitHub. - In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/ed3c81d7322bb8058615095f4aab28c147c53933/.github/workflows/artifact_snyk_test.yml#L179) + In [this YAML file](https://github.com/cyber-dojo/snyk-scanning/blob/30111f180ac4e3611cdbd7d805381a0bb9f53cff/.github/workflows/artifact_snyk_test.yml#L180) diff --git a/client_reference/kosli_get_api-key.md b/client_reference/kosli_get_api-key.md index 24b19f16..319595da 100644 --- a/client_reference/kosli_get_api-key.md +++ b/client_reference/kosli_get_api-key.md @@ -26,7 +26,7 @@ returned (it is only shown once, at creation or rotation time). | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_artifact.md b/client_reference/kosli_get_artifact.md index 4d7df416..c7ea0810 100644 --- a/client_reference/kosli_get_artifact.md +++ b/client_reference/kosli_get_artifact.md @@ -39,7 +39,7 @@ Examples of valid expressions are: | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_attestation-type.md b/client_reference/kosli_get_attestation-type.md index 08c06836..181c3056 100644 --- a/client_reference/kosli_get_attestation-type.md +++ b/client_reference/kosli_get_attestation-type.md @@ -31,7 +31,7 @@ The TYPE-NAME can be specified as follows: | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_attestation.md b/client_reference/kosli_get_attestation.md index 32faadf5..cbf41d33 100644 --- a/client_reference/kosli_get_attestation.md +++ b/client_reference/kosli_get_attestation.md @@ -37,7 +37,7 @@ or any of the `--flow`, `--trail` or `--fingerprint` flags. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -104,11 +104,11 @@ kosli get attestation snyk-container-scan --flow=differ-ci --fingerprint=0cbbe3a ] }, "attestation_id": "f7cd9b3a-2738-47e6-be36-689d511d", - "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6?attestation_id=f7cd9b3a-2738-47e6-be36-689d511d", "flow_name": "differ-ci", "trail_name": "5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6", "reported_by": "ci-pipelines", "has_audit_package": true, + "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/5ccc5c141fdd1fbd97905b7fe0af87e5a592bfb6?attestation_id=f7cd9b3a-2738-47e6-be36-689d511d", "_links": { "self": { "href": "https://app.kosli.com/api/v2/attestations/cyber-dojo/differ-ci/artifact/0cbbe3a6e73e733e8ca4b8813738d68e824badad0508ff20842832b5143b48c0/snyk-container-scan" diff --git a/client_reference/kosli_get_control.md b/client_reference/kosli_get_control.md index ab0a8fe2..2e669c0a 100644 --- a/client_reference/kosli_get_control.md +++ b/client_reference/kosli_get_control.md @@ -27,7 +27,7 @@ Get a Kosli control. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_default-org.md b/client_reference/kosli_get_default-org.md index 93a03cd5..5db75824 100644 --- a/client_reference/kosli_get_default-org.md +++ b/client_reference/kosli_get_default-org.md @@ -23,7 +23,7 @@ The default organization is the one selected by default in the Kosli Web UI when | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_environment.md b/client_reference/kosli_get_environment.md index e2c6f6bb..7f25061b 100644 --- a/client_reference/kosli_get_environment.md +++ b/client_reference/kosli_get_environment.md @@ -22,7 +22,7 @@ Get an environment's metadata. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -50,9 +50,9 @@ kosli get environment aws-prod --output=json "name": "aws-prod", "type": "ECS", "description": "The ECS cluster for production cyber-dojo", - "last_modified_at": 1788260398.5436597, - "last_reported_at": 1788260398.5436597, - "last_changed_at": 1788256325.6192138, + "last_modified_at": 1789114018.585112, + "last_reported_at": 1789114018.585112, + "last_changed_at": 1789108858.5535865, "state": true, "include_scaling": false, "tags": { diff --git a/client_reference/kosli_get_flow.md b/client_reference/kosli_get_flow.md index 644afd3a..3b925a9c 100644 --- a/client_reference/kosli_get_flow.md +++ b/client_reference/kosli_get_flow.md @@ -22,7 +22,7 @@ Get the metadata of a specific flow. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_policy.md b/client_reference/kosli_get_policy.md index 411fed71..ae08029e 100644 --- a/client_reference/kosli_get_policy.md +++ b/client_reference/kosli_get_policy.md @@ -22,7 +22,7 @@ Get a policy's metadata. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_repo.md b/client_reference/kosli_get_repo.md index f972ce2f..700278f2 100644 --- a/client_reference/kosli_get_repo.md +++ b/client_reference/kosli_get_repo.md @@ -30,7 +30,7 @@ across VCS providers. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_service-account.md b/client_reference/kosli_get_service-account.md index 260b7ba9..49e7d8ee 100644 --- a/client_reference/kosli_get_service-account.md +++ b/client_reference/kosli_get_service-account.md @@ -26,7 +26,7 @@ to get the raw response for scripting. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_get_snapshot.md b/client_reference/kosli_get_snapshot.md index 4b4cf96d..f159bdad 100644 --- a/client_reference/kosli_get_snapshot.md +++ b/client_reference/kosli_get_snapshot.md @@ -39,7 +39,7 @@ ENVIRONMENT-NAME-OR-EXPRESSION can be specified as follows: | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -64,7 +64,7 @@ kosli get snapshot aws-prod --output=json ```json { - "index": 5309, + "index": 5352, "is_latest": true, "next_snapshot_timestamp": null, "artifact_compliance_count": { @@ -72,18 +72,18 @@ kosli get snapshot aws-prod --output=json "false": 0, "null": 0 }, - "timestamp": 1788256325.6192138, + "timestamp": 1789108858.5535865, "type": "ECS", "compliant": true, - "html_url": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309", + "html_url": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5352", "artifacts": [ { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:99d7b74@sha256:a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -101,23 +101,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } }, @@ -125,7 +125,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } } @@ -146,23 +146,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } }, @@ -170,7 +170,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } } @@ -181,10 +181,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -193,26 +193,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } }, @@ -220,14 +220,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -248,23 +248,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } }, @@ -272,7 +272,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } } @@ -293,23 +293,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } }, @@ -317,7 +317,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } } @@ -343,7 +343,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -351,8 +351,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -360,8 +360,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -370,7 +370,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -381,7 +381,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -399,23 +399,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } }, @@ -423,7 +423,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } } @@ -444,23 +444,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } }, @@ -468,7 +468,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } } @@ -479,60 +479,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -550,23 +546,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } }, @@ -574,7 +570,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } } @@ -595,23 +591,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } }, @@ -619,7 +615,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } } @@ -630,12 +626,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -645,38 +641,42 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", - "artifact_status": null + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "artifact_status": null + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -697,23 +697,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } }, @@ -721,7 +721,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": null } } @@ -748,23 +748,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } }, @@ -772,7 +772,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "artifact_status": "COMPLIANT" } } @@ -783,9 +783,9 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "fingerprint": "a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "creationTimestamp": [ - 1788256052 + 1789023319 ], "pods": null, "annotation": { @@ -794,161 +794,161 @@ kosli get snapshot aws-prod --output=json "now": 1 }, "flow_name": "creator-ci", - "git_commit": "d64d2b11879179255f11dc991e81fbaf4a040264", - "commit_url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264", - "html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e", + "git_commit": "99d7b74f39e311d492902ad48dbe97da63f2c687", + "commit_url": "https://github.com/cyber-dojo/creator/commit/99d7b74f39e311d492902ad48dbe97da63f2c687", + "html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=205424b6-5741-4071-bd36-c26e83f6", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264", - "previous_git_commit": "83357f112ef5c10b157cb84732c77965cc8ddc48", - "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", + "diff_url": "https://github.com/cyber-dojo/creator/compare/abdc61396b5031dbb1e90f5c9c190d303ff243e1...99d7b74f39e311d492902ad48dbe97da63f2c687", + "previous_git_commit": "abdc61396b5031dbb1e90f5c9c190d303ff243e1", + "previous_fingerprint": "ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:abdc613@sha256:ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/creator/commit/83357f112ef5c10b157cb84732c77965cc8ddc48", - "previous_trail_name": "83357f112ef5c10b157cb84732c77965cc8ddc48", + "previous_git_commit_url": "https://github.com/cyber-dojo/creator/commit/abdc61396b5031dbb1e90f5c9c190d303ff243e1", + "previous_trail_name": "abdc61396b5031dbb1e90f5c9c190d303ff243e1", "previous_template_reference_name": "creator" }, - "commit_lead_time": 420668.0, + "commit_lead_time": 3383.0, "flows": [ { "flow_name": "creator-ci", - "trail_name": "d64d2b11879179255f11dc991e81fbaf4a040264", + "trail_name": "99d7b74f39e311d492902ad48dbe97da63f2c687", "template_reference_name": "creator", - "git_commit": "d64d2b11879179255f11dc991e81fbaf4a040264", - "commit_url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264", + "git_commit": "99d7b74f39e311d492902ad48dbe97da63f2c687", + "commit_url": "https://github.com/cyber-dojo/creator/commit/99d7b74f39e311d492902ad48dbe97da63f2c687", "git_commit_info": { - "sha1": "d64d2b11879179255f11dc991e81fbaf4a040264", - "message": "Merge update-base-image into main (#56)\n\n* Dockerfile - Automated base-image update\n\n* Make the test harness work on the simplecov the new base image carries\n\n The automated base-image bump brings simplecov 0.21.2 -> 1.1.1, and\n three things here were written against the older one. Only the first\n fails the build; the other two announce themselves on stderr every run.\n\n simplecov_json.rb reopened SimpleCov::Formatter::JSONFormatter to\n redefine format. In 1.1.1 that class defines format itself, so ruby -w\n reports the redefinition twice and test_log_warnings goes from 0 to 2.\n It is now CoverageMetricsFormatter, named for the coverage_metrics.json\n it writes, which is the same name runner gives the same job. It never\n needed to be that class: what it produces is per-group totals, not the\n per-file shape the shipped formatter writes, so it was only borrowing\n the name to make itself win.\n\n SimpleCov.add_group is deprecated in favour of group. The block\n parameter goes from src to path while passing, since it is a source\n file in both groups and src said otherwise in the test one.\n\n # :nocov: is deprecated in favour of # simplecov:disable / :enable. The\n pair wrapping id58_test_base.rb is the only one in the repo.\n\n Coverage is unchanged: code.lines.total 526, test.lines.total 677,\n nothing missed in either. coverage.rb already cleared filters, so the\n test group survived 1.1.1 tightening the default test_frameworks skip\n to an anchored regex, which is what caught start-points-base out.\n\n---------\n\nCo-authored-by: JonJagger ", + "sha1": "99d7b74f39e311d492902ad48dbe97da63f2c687", + "message": "Remove upgrade notice (#60)", "author": "Jon Jagger ", "branch": "", - "timestamp": 1787835384.0, - "url": "https://github.com/cyber-dojo/creator/commit/d64d2b11879179255f11dc991e81fbaf4a040264" + "timestamp": 1789019936.0, + "url": "https://github.com/cyber-dojo/creator/commit/99d7b74f39e311d492902ad48dbe97da63f2c687" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e", + "html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=205424b6-5741-4071-bd36-c26e83f6", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/creator-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264", - "previous_git_commit": "83357f112ef5c10b157cb84732c77965cc8ddc48", - "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", + "diff_url": "https://github.com/cyber-dojo/creator/compare/abdc61396b5031dbb1e90f5c9c190d303ff243e1...99d7b74f39e311d492902ad48dbe97da63f2c687", + "previous_git_commit": "abdc61396b5031dbb1e90f5c9c190d303ff243e1", + "previous_fingerprint": "ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:abdc613@sha256:ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/creator/commit/83357f112ef5c10b157cb84732c77965cc8ddc48", - "previous_trail_name": "83357f112ef5c10b157cb84732c77965cc8ddc48", + "previous_git_commit_url": "https://github.com/cyber-dojo/creator/commit/abdc61396b5031dbb1e90f5c9c190d303ff243e1", + "previous_trail_name": "abdc61396b5031dbb1e90f5c9c190d303ff243e1", "previous_template_reference_name": "creator" }, - "commit_lead_time": 420668.0, + "commit_lead_time": 3383.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "flow_name": "production-promotion", + "trail_name": "promotion-one-165", "template_reference_name": "creator", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", + "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "message": "Drop lone use of = separator on Kosli CLI boolean flag", "author": "JonJagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1785316994.0, + "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=5d73a605-4286-4a94-be8c-e2262a67", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=a6ea2552-c978-4a49-a9c1-91f3402a", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", + "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_fingerprint": "ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:abdc613@sha256:ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "creator-adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", + "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_trail_name": "promote-all-35", "previous_template_reference_name": "creator" }, - "commit_lead_time": 594065.0, + "commit_lead_time": 3706325.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "template_reference_name": "creator", - "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "message": "Drop lone use of = separator on Kosli CLI boolean flag", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1785316994.0, - "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=615d01cb-77c4-4429-9531-60460983", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=8538b0e6-c57c-4137-9e81-53163437", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_fingerprint": "ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:abdc613@sha256:ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_trail_name": "creator-ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_template_reference_name": "creator" }, - "commit_lead_time": 2939058.0, + "commit_lead_time": 77664.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "creator-c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "trail_name": "creator-a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "template_reference_name": "creator", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=d4d51513-4c22-4eb3-b8b3-caa88478", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=55242b51-f519-487f-beb5-9d02017c", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/7172cc22125f480a9f12127edb481a4d84aabea3...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "7172cc22125f480a9f12127edb481a4d84aabea3", - "previous_fingerprint": "e8b5e25c5550658cdbd2b8339684b18bce86aaf6538611124ff62f2582c2e5b6", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:a288de5@sha256:e8b5e25c5550658cdbd2b8339684b18bce86aaf6538611124ff62f2582c2e5b6", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/30111f180ac4e3611cdbd7d805381a0bb9f53cff...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_fingerprint": "ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:abdc613@sha256:ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/7172cc22125f480a9f12127edb481a4d84aabea3", - "previous_trail_name": "creator-e8b5e25c5550658cdbd2b8339684b18bce86aaf6538611124ff62f2582c2e5b6", + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_trail_name": "creator-ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", "previous_template_reference_name": "creator" }, - "commit_lead_time": 594065.0, + "commit_lead_time": 77664.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/3497b80bc2ff41e792b5ca4a833882fc", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/f5fb12ba8c944853886ff4f0faffde50", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:236898f@sha256:e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -965,24 +965,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } }, @@ -990,7 +990,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } } @@ -1010,24 +1010,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } }, @@ -1035,7 +1035,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } } @@ -1046,10 +1046,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -1058,26 +1058,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } }, @@ -1085,14 +1085,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -1112,24 +1112,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } }, @@ -1137,7 +1137,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } } @@ -1157,24 +1157,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } }, @@ -1182,7 +1182,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } } @@ -1207,8 +1207,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -1216,8 +1216,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -1225,8 +1225,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -1235,7 +1235,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -1246,7 +1246,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -1263,24 +1263,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } }, @@ -1288,7 +1288,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } } @@ -1308,24 +1308,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } }, @@ -1333,7 +1333,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } } @@ -1344,60 +1344,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -1414,24 +1410,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } }, @@ -1439,7 +1435,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } } @@ -1459,24 +1455,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } }, @@ -1484,7 +1480,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } } @@ -1495,12 +1491,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -1509,39 +1505,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "artifact_status": null + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "artifact_status": null + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -1561,24 +1561,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } }, @@ -1586,7 +1586,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": null } } @@ -1612,24 +1612,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } }, @@ -1637,7 +1637,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "artifact_status": "COMPLIANT" } } @@ -1648,100 +1648,71 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "fingerprint": "e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", "creationTimestamp": [ - 1788255750 + 1789022826, + 1789022880, + 1789022884 ], "pods": null, "annotation": { - "type": "updated-provenance", - "was": 1, - "now": 1 + "type": "unchanged", + "was": 3, + "now": 3 }, - "flow_name": "nginx-ci", - "git_commit": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=9045bb07-ea42-482f-99c3-4fe5b86f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci", + "flow_name": "web-ci", + "git_commit": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "commit_url": "https://github.com/cyber-dojo/web/commit/236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418?artifact_id=9d418e45-a78d-462a-b8be-aaf2fc85", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/nginx/compare/fb791742054fa28dd89269aac8002ebfd7b3386e...27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "previous_git_commit": "fb791742054fa28dd89269aac8002ebfd7b3386e", - "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", + "diff_url": "https://github.com/cyber-dojo/web/compare/cbe481c4b842f897e4e9e411cd78461a3a12a334...236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "previous_git_commit": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "previous_fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/nginx/commit/fb791742054fa28dd89269aac8002ebfd7b3386e", - "previous_trail_name": "fb791742054fa28dd89269aac8002ebfd7b3386e", - "previous_template_reference_name": "nginx" + "previous_git_commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334", + "previous_trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "previous_template_reference_name": "web" }, - "commit_lead_time": 1790.0, + "commit_lead_time": 88708.0, "flows": [ { - "flow_name": "nginx-ci", - "trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "template_reference_name": "nginx", - "git_commit": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "flow_name": "web-ci", + "trail_name": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "template_reference_name": "web", + "git_commit": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "commit_url": "https://github.com/cyber-dojo/web/commit/236898f12a3bcce3b60625dd71c6f817d4cc37c2", "git_commit_info": { - "sha1": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "message": "Merge pull request #169 from cyber-dojo/run-workflow-to-pick-up-fixes-to-snyk-vulns\n\nRun workflow to pick up fixes to new snyk vulns", + "sha1": "236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "message": "Dockerfile - Automated base-image update (#425)\n\nCo-authored-by: JonJagger ", "author": "Jon Jagger ", "branch": "", - "timestamp": 1788253960.0, - "url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65" - }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=9045bb07-ea42-482f-99c3-4fe5b86f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci", - "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/nginx/compare/fb791742054fa28dd89269aac8002ebfd7b3386e...27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", - "previous_git_commit": "fb791742054fa28dd89269aac8002ebfd7b3386e", - "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", - "previous_artifact_compliance_state": "COMPLIANT", - "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/nginx/commit/fb791742054fa28dd89269aac8002ebfd7b3386e", - "previous_trail_name": "fb791742054fa28dd89269aac8002ebfd7b3386e", - "previous_template_reference_name": "nginx" + "timestamp": 1788778385.0, + "url": "https://github.com/cyber-dojo/web/commit/236898f12a3bcce3b60625dd71c6f817d4cc37c2" }, - "commit_lead_time": 1790.0, - "artifact_compliance_in_flow": true, - "flow_reasons_for_non_compliance": [] - }, - { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "template_reference_name": "nginx", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", - "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", - "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" - }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=d14d27b1-2d09-43a9-bf35-f58f3164", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418?artifact_id=9d418e45-a78d-462a-b8be-aaf2fc85", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", + "diff_url": "https://github.com/cyber-dojo/web/compare/cbe481c4b842f897e4e9e411cd78461a3a12a334...236898f12a3bcce3b60625dd71c6f817d4cc37c2", + "previous_git_commit": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "previous_fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "nginx-b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", - "previous_template_reference_name": "nginx" + "previous_git_commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334", + "previous_trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "previous_template_reference_name": "web" }, - "commit_lead_time": 593763.0, + "commit_lead_time": 88708.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "nginx", + "trail_name": "promote-all-35", + "template_reference_name": "web", "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { @@ -1752,68 +1723,99 @@ kosli get snapshot aws-prod --output=json "timestamp": 1785316994.0, "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=1b78fe0b-61c8-4e00-bc5a-d54ae788", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418?artifact_id=2db7454f-b774-4c13-b755-516ec573", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:fb79174@sha256:b70ff1f9493f5d4205e0e95e565b3fc4d909de237b10e490b250671d0d6895cf", + "previous_fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", - "previous_template_reference_name": "nginx" + "previous_trail_name": "promotion-one-161", + "previous_template_reference_name": "web" + }, + "commit_lead_time": 3550099.0, + "artifact_compliance_in_flow": true, + "flow_reasons_for_non_compliance": [] + }, + { + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "template_reference_name": "web", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "git_commit_info": { + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", + "branch": "main", + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" + }, + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418?artifact_id=f65df9d1-cb49-4f5a-a751-785138de", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "deployment_diff": { + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "previous_artifact_compliance_state": "NON-COMPLIANT", + "previous_running": false, + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "previous_template_reference_name": "web" }, - "commit_lead_time": 2938756.0, + "commit_lead_time": -78562.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "template_reference_name": "nginx", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "web-e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "template_reference_name": "web", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=c340a947-0136-4de1-acc8-2a89f741", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418?artifact_id=60234182-f1d9-4d59-aa4e-2d29180f", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:7065268@sha256:b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8", + "previous_fingerprint": "29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:f66cc5c@sha256:29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "nginx-b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8", - "previous_template_reference_name": "nginx" + "previous_trail_name": "web-29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4", + "previous_template_reference_name": "web" }, - "commit_lead_time": 593763.0, + "commit_lead_time": -78562.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/675ca6104c294b369094b918f30ab6b9", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/f800bdc877ff4579aff38aae2a2b8db9", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:4b2bfc0@sha256:8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -1830,24 +1832,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } }, @@ -1855,7 +1857,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } } @@ -1875,24 +1877,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } }, @@ -1900,7 +1902,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } } @@ -1911,10 +1913,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -1923,26 +1925,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } }, @@ -1950,14 +1952,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -1977,24 +1979,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } }, @@ -2002,7 +2004,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } } @@ -2022,24 +2024,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } }, @@ -2047,7 +2049,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } } @@ -2072,8 +2074,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2081,8 +2083,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2090,8 +2092,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2100,7 +2102,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2111,7 +2113,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -2128,24 +2130,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } }, @@ -2153,7 +2155,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } } @@ -2173,24 +2175,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } }, @@ -2198,7 +2200,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } } @@ -2209,60 +2211,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -2279,24 +2277,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } }, @@ -2304,7 +2302,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } } @@ -2324,24 +2322,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } }, @@ -2349,7 +2347,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } } @@ -2360,12 +2358,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -2374,39 +2372,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", - "artifact_status": null + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "artifact_status": null + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -2426,24 +2428,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } }, @@ -2451,7 +2453,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": null } } @@ -2477,24 +2479,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } }, @@ -2502,7 +2504,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "artifact_status": "COMPLIANT" } } @@ -2513,100 +2515,71 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "fingerprint": "8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", "creationTimestamp": [ - 1788255750 + 1789022821, + 1789022872, + 1789022877 ], "pods": null, "annotation": { - "type": "updated-provenance", - "was": 1, - "now": 1 + "type": "unchanged", + "was": 3, + "now": 3 }, - "flow_name": "languages-start-points-ci", - "git_commit": "a357ebd85acdd54968fa0192405aaf2e289d27c9", - "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9", - "html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8e028a8d-a1f2-4732-8663-47012b29", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci", + "flow_name": "runner-ci", + "git_commit": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "commit_url": "https://github.com/cyber-dojo/runner/commit/4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f?artifact_id=612b9903-ce02-40a7-a329-77b10931", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/languages-start-points/compare/068b3424c7da843a4f2d428d2e4915f33efc4a02...a357ebd85acdd54968fa0192405aaf2e289d27c9", - "previous_git_commit": "068b3424c7da843a4f2d428d2e4915f33efc4a02", - "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", + "diff_url": "https://github.com/cyber-dojo/runner/compare/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9...4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "previous_git_commit": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "previous_fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/068b3424c7da843a4f2d428d2e4915f33efc4a02", - "previous_trail_name": "068b3424c7da843a4f2d428d2e4915f33efc4a02", - "previous_template_reference_name": "languages-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "previous_trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "previous_template_reference_name": "runner" }, - "commit_lead_time": 10038.0, + "commit_lead_time": 88837.0, "flows": [ { - "flow_name": "languages-start-points-ci", - "trail_name": "a357ebd85acdd54968fa0192405aaf2e289d27c9", - "template_reference_name": "languages-start-points", - "git_commit": "a357ebd85acdd54968fa0192405aaf2e289d27c9", - "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9", + "flow_name": "runner-ci", + "trail_name": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "template_reference_name": "runner", + "git_commit": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "commit_url": "https://github.com/cyber-dojo/runner/commit/4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "git_commit_info": { - "sha1": "a357ebd85acdd54968fa0192405aaf2e289d27c9", - "message": "Merge pull request #252 from cyber-dojo/speed-updates-to-slowest-ltfs\n\nSpeed updates to the slowest LTFs", + "sha1": "4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "message": "Dockerfile - Automated base-image update (#312)\n\nCo-authored-by: JonJagger ", "author": "Jon Jagger ", "branch": "", - "timestamp": 1788245712.0, - "url": "https://github.com/cyber-dojo/languages-start-points/commit/a357ebd85acdd54968fa0192405aaf2e289d27c9" - }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8e028a8d-a1f2-4732-8663-47012b29", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci", - "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/languages-start-points/compare/068b3424c7da843a4f2d428d2e4915f33efc4a02...a357ebd85acdd54968fa0192405aaf2e289d27c9", - "previous_git_commit": "068b3424c7da843a4f2d428d2e4915f33efc4a02", - "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", - "previous_artifact_compliance_state": "COMPLIANT", - "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/068b3424c7da843a4f2d428d2e4915f33efc4a02", - "previous_trail_name": "068b3424c7da843a4f2d428d2e4915f33efc4a02", - "previous_template_reference_name": "languages-start-points" - }, - "commit_lead_time": 10038.0, - "artifact_compliance_in_flow": true, - "flow_reasons_for_non_compliance": [] - }, - { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "template_reference_name": "languages-start-points", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", - "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", - "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788778348.0, + "url": "https://github.com/cyber-dojo/runner/commit/4b2bfc038576e2a7648090c4c1289fbc9ebfc481" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8b7fa132-7335-4301-a248-b13e4286", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f?artifact_id=612b9903-ce02-40a7-a329-77b10931", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", + "diff_url": "https://github.com/cyber-dojo/runner/compare/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9...4b2bfc038576e2a7648090c4c1289fbc9ebfc481", + "previous_git_commit": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "previous_fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "languages-start-points-adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", - "previous_template_reference_name": "languages-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "previous_trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "previous_template_reference_name": "runner" }, - "commit_lead_time": 593763.0, + "commit_lead_time": 88837.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "languages-start-points", + "trail_name": "promote-all-35", + "template_reference_name": "runner", "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { @@ -2617,68 +2590,99 @@ kosli get snapshot aws-prod --output=json "timestamp": 1785316994.0, "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=790a39b3-0c7c-4220-9d6b-63bff0f3", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f?artifact_id=bf1d6fdd-5fa4-410f-a897-ad33e40a", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:068b342@sha256:adf2596645ae3fe9b711849a2e9aae3a65173b270963e3214b9c7ea00b03c1cb", + "previous_fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", - "previous_template_reference_name": "languages-start-points" + "previous_trail_name": "promote-all-34", + "previous_template_reference_name": "runner" + }, + "commit_lead_time": 3550191.0, + "artifact_compliance_in_flow": true, + "flow_reasons_for_non_compliance": [] + }, + { + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "template_reference_name": "runner", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "git_commit_info": { + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", + "branch": "main", + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" + }, + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f?artifact_id=fbdfe540-f0e7-4b68-9bab-b752fe2a", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "deployment_diff": { + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "previous_artifact_compliance_state": "COMPLIANT", + "previous_running": false, + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "previous_template_reference_name": "runner" }, - "commit_lead_time": 2938756.0, + "commit_lead_time": -78470.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "template_reference_name": "languages-start-points", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "runner-8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "template_reference_name": "runner", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=400979c3-f9c3-4652-8b12-2204fabb", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f?artifact_id=f448662b-6bdd-4d64-80ef-3072846d", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:7e86fed@sha256:b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:d7541d3@sha256:fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "languages-start-points-b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676", - "previous_template_reference_name": "languages-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "runner-fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", + "previous_template_reference_name": "runner" }, - "commit_lead_time": 593763.0, + "commit_lead_time": -78470.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/cbb20953281f4b168eb98575717b01e7", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/ecc3523886774c3791136a12495d567c", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:6b20a42@sha256:4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -2695,24 +2699,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } }, @@ -2720,7 +2724,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } } @@ -2740,24 +2744,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } }, @@ -2765,7 +2769,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } } @@ -2776,10 +2780,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -2788,26 +2792,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } }, @@ -2815,14 +2819,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -2842,24 +2846,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } }, @@ -2867,7 +2871,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } } @@ -2887,24 +2891,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } }, @@ -2912,7 +2916,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } } @@ -2937,8 +2941,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2946,8 +2950,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2955,8 +2959,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2965,7 +2969,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -2976,7 +2980,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -2993,24 +2997,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } }, @@ -3018,7 +3022,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } } @@ -3038,24 +3042,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } }, @@ -3063,7 +3067,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } } @@ -3074,60 +3078,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -3144,24 +3144,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } }, @@ -3169,7 +3169,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } } @@ -3189,24 +3189,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } }, @@ -3214,7 +3214,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } } @@ -3225,12 +3225,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -3239,39 +3239,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "artifact_status": null + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "artifact_status": null + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -3291,24 +3295,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } }, @@ -3316,7 +3320,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": null } } @@ -3342,8 +3346,16 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "artifact_status": "COMPLIANT" + } + }, + { + "type": "rule_satisfied", + "context": { + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, @@ -3351,15 +3363,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "artifact_status": "COMPLIANT" - } - }, - { - "type": "rule_satisfied", - "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } }, @@ -3367,7 +3371,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "artifact_status": "COMPLIANT" } } @@ -3378,172 +3382,172 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "fingerprint": "4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "creationTimestamp": [ - 1788255398 + 1789022830 ], "pods": null, "annotation": { - "type": "updated-provenance", + "type": "unchanged", "was": 1, "now": 1 }, - "flow_name": "custom-start-points-ci", - "git_commit": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=2aa23627-9e91-488e-b3ea-e4bf2e22", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci", + "flow_name": "dashboard-ci", + "git_commit": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "commit_url": "https://github.com/cyber-dojo/dashboard/commit/6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=7ba704a0-8706-4f12-9eb8-776c7e5d", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/custom-start-points/compare/790d86b66f4d86ab47f5c521daf5039dc8aeef4d...b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "previous_git_commit": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d", - "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", + "diff_url": "https://github.com/cyber-dojo/dashboard/compare/ff9f292e809801d35246183988b7812826bc2760...6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "previous_git_commit": "ff9f292e809801d35246183988b7812826bc2760", + "previous_fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/790d86b66f4d86ab47f5c521daf5039dc8aeef4d", - "previous_trail_name": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d", - "previous_template_reference_name": "custom-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760", + "previous_trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "previous_template_reference_name": "dashboard" }, - "commit_lead_time": 416881.0, + "commit_lead_time": 89179.0, "flows": [ { - "flow_name": "custom-start-points-ci", - "trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "template_reference_name": "custom-start-points", - "git_commit": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "flow_name": "dashboard-ci", + "trail_name": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "template_reference_name": "dashboard", + "git_commit": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "commit_url": "https://github.com/cyber-dojo/dashboard/commit/6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "git_commit_info": { - "sha1": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "message": "Merge pull request #143 from cyber-dojo/update-base-image-ce45d62\n\nMerge update-base-image into main", + "sha1": "6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "message": "Dockerfile - Automated base-image update (#438)\n\nCo-authored-by: JonJagger ", "author": "Jon Jagger ", "branch": "", - "timestamp": 1787838517.0, - "url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2" + "timestamp": 1788778346.0, + "url": "https://github.com/cyber-dojo/dashboard/commit/6b20a423d5ce05139d4480e9ce67f40e3eda2e07" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=2aa23627-9e91-488e-b3ea-e4bf2e22", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci", + "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=7ba704a0-8706-4f12-9eb8-776c7e5d", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/custom-start-points/compare/790d86b66f4d86ab47f5c521daf5039dc8aeef4d...b12a5c9b17023462d13e81381a69c7ef05f84dc2", - "previous_git_commit": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d", - "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", + "diff_url": "https://github.com/cyber-dojo/dashboard/compare/ff9f292e809801d35246183988b7812826bc2760...6b20a423d5ce05139d4480e9ce67f40e3eda2e07", + "previous_git_commit": "ff9f292e809801d35246183988b7812826bc2760", + "previous_fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/790d86b66f4d86ab47f5c521daf5039dc8aeef4d", - "previous_trail_name": "790d86b66f4d86ab47f5c521daf5039dc8aeef4d", - "previous_template_reference_name": "custom-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760", + "previous_trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "previous_template_reference_name": "dashboard" }, - "commit_lead_time": 416881.0, + "commit_lead_time": 89179.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "template_reference_name": "custom-start-points", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "template_reference_name": "dashboard", + "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", + "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "message": "Drop lone use of = separator on Kosli CLI boolean flag", "author": "JonJagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1785316994.0, + "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=b5dae6e2-12e1-47bc-a361-ead8aa3f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=26333282-8be1-4a1a-b142-1b3c958b", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", + "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "custom-start-points-8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", - "previous_template_reference_name": "custom-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_trail_name": "promote-all-34", + "previous_template_reference_name": "dashboard" }, - "commit_lead_time": 593411.0, + "commit_lead_time": 3550531.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "custom-start-points", - "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "template_reference_name": "dashboard", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "message": "Drop lone use of = separator on Kosli CLI boolean flag", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1785316994.0, - "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=63e61c31-696e-4465-9145-2c51f6d4", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=6cdd9974-d138-48f0-b02b-88a08901", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/81c216a55b2cb1787645e699ceaceca868cad253...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_git_commit": "81c216a55b2cb1787645e699ceaceca868cad253", - "previous_fingerprint": "8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:790d86b@sha256:8e965dda26af2d2e68032c25d68e792c85e0c7bd9814862de231bc4c6e935b81", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/81c216a55b2cb1787645e699ceaceca868cad253", - "previous_trail_name": "promote-all-31", - "previous_template_reference_name": "custom-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "previous_template_reference_name": "dashboard" }, - "commit_lead_time": 2938404.0, + "commit_lead_time": -78130.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "template_reference_name": "custom-start-points", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "dashboard-4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "template_reference_name": "dashboard", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=ff77dce2-dd84-40ff-b134-d21758f5", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=de8c1b00-91bd-4bd0-908a-4544ec15", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:6b5c159@sha256:b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928", + "previous_fingerprint": "45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:87f560f@sha256:45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "custom-start-points-b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928", - "previous_template_reference_name": "custom-start-points" + "previous_trail_name": "dashboard-45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c", + "previous_template_reference_name": "dashboard" }, - "commit_lead_time": 593411.0, + "commit_lead_time": -78130.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/b7894ad2c80e4774adbeab8165291101", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/1009a1194f024e6ea07508acbedf904a", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:84e986a@sha256:06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:5d1d4b6@sha256:040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -3560,24 +3564,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } }, @@ -3585,7 +3589,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } } @@ -3605,24 +3609,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } }, @@ -3630,7 +3634,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } } @@ -3641,10 +3645,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -3653,26 +3657,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } }, @@ -3680,14 +3684,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -3707,24 +3711,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } }, @@ -3732,7 +3736,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } } @@ -3752,24 +3756,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } }, @@ -3777,7 +3781,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } } @@ -3802,8 +3806,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -3811,8 +3815,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -3820,8 +3824,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -3830,7 +3834,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -3841,7 +3845,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -3858,24 +3862,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } }, @@ -3883,7 +3887,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } } @@ -3903,24 +3907,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } }, @@ -3928,7 +3932,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } } @@ -3939,60 +3943,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -4009,24 +4009,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } }, @@ -4034,7 +4034,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } } @@ -4054,24 +4054,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } }, @@ -4079,7 +4079,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } } @@ -4090,12 +4090,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -4104,39 +4104,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "artifact_status": null + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "artifact_status": null + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -4156,24 +4160,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } }, @@ -4181,7 +4185,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": null } } @@ -4207,24 +4211,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } }, @@ -4232,7 +4236,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "artifact_status": "COMPLIANT" } } @@ -4243,172 +4247,172 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "fingerprint": "040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "creationTimestamp": [ - 1788255396 + 1789022826 ], "pods": null, "annotation": { - "type": "updated-provenance", + "type": "unchanged", "was": 1, "now": 1 }, - "flow_name": "saver-ci", - "git_commit": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "commit_url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=a599cb04-5965-46a6-a774-24dc6341", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci", + "flow_name": "languages-start-points-ci", + "git_commit": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909?artifact_id=f5813ac8-1ad7-433a-beee-f90a065d", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/saver/compare/36f0420f728fe61e44a3ab0043cf9a3d70863cad...84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "previous_git_commit": "36f0420f728fe61e44a3ab0043cf9a3d70863cad", - "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", + "diff_url": "https://github.com/cyber-dojo/languages-start-points/compare/8e6b51867675d4b652a38353611cde1d8567fce0...5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "previous_git_commit": "8e6b51867675d4b652a38353611cde1d8567fce0", + "previous_fingerprint": "77bd283ca309eb2e7c88d8634ba19c66637c7030cae8129d6835cc4d450d742d", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:8e6b518@sha256:77bd283ca309eb2e7c88d8634ba19c66637c7030cae8129d6835cc4d450d742d", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/saver/commit/36f0420f728fe61e44a3ab0043cf9a3d70863cad", - "previous_trail_name": "36f0420f728fe61e44a3ab0043cf9a3d70863cad", - "previous_template_reference_name": "saver" + "previous_git_commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/8e6b51867675d4b652a38353611cde1d8567fce0", + "previous_trail_name": "8e6b51867675d4b652a38353611cde1d8567fce0", + "previous_template_reference_name": "languages-start-points" }, - "commit_lead_time": 3241.0, + "commit_lead_time": 6198.0, "flows": [ { - "flow_name": "saver-ci", - "trail_name": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "template_reference_name": "saver", - "git_commit": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "commit_url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "flow_name": "languages-start-points-ci", + "trail_name": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "template_reference_name": "languages-start-points", + "git_commit": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/5d1d4b6035691d7986e05ab263e521b3e711fa0c", "git_commit_info": { - "sha1": "84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "message": "Run workflow to pick up fixes to expat vulns (#443)", + "sha1": "5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "message": "Merge pull request #267 from cyber-dojo/update-base-image-a2388c1\n\nMerge update-base-image into main", "author": "Jon Jagger ", "branch": "", - "timestamp": 1788252155.0, - "url": "https://github.com/cyber-dojo/saver/commit/84e986ad70d32e9be362d5bd9ce7c7af94f6eaab" + "timestamp": 1788860897.0, + "url": "https://github.com/cyber-dojo/languages-start-points/commit/5d1d4b6035691d7986e05ab263e521b3e711fa0c" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=a599cb04-5965-46a6-a774-24dc6341", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci", + "html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909?artifact_id=f5813ac8-1ad7-433a-beee-f90a065d", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/saver/compare/36f0420f728fe61e44a3ab0043cf9a3d70863cad...84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", - "previous_git_commit": "36f0420f728fe61e44a3ab0043cf9a3d70863cad", - "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", + "diff_url": "https://github.com/cyber-dojo/languages-start-points/compare/8e6b51867675d4b652a38353611cde1d8567fce0...5d1d4b6035691d7986e05ab263e521b3e711fa0c", + "previous_git_commit": "8e6b51867675d4b652a38353611cde1d8567fce0", + "previous_fingerprint": "77bd283ca309eb2e7c88d8634ba19c66637c7030cae8129d6835cc4d450d742d", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:8e6b518@sha256:77bd283ca309eb2e7c88d8634ba19c66637c7030cae8129d6835cc4d450d742d", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/saver/commit/36f0420f728fe61e44a3ab0043cf9a3d70863cad", - "previous_trail_name": "36f0420f728fe61e44a3ab0043cf9a3d70863cad", - "previous_template_reference_name": "saver" + "previous_git_commit_url": "https://github.com/cyber-dojo/languages-start-points/commit/8e6b51867675d4b652a38353611cde1d8567fce0", + "previous_trail_name": "8e6b51867675d4b652a38353611cde1d8567fce0", + "previous_template_reference_name": "languages-start-points" }, - "commit_lead_time": 3241.0, + "commit_lead_time": 6198.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "template_reference_name": "saver", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "template_reference_name": "languages-start-points", + "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", + "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "message": "Drop lone use of = separator on Kosli CLI boolean flag", "author": "JonJagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1785316994.0, + "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=954a634e-bcc4-4aeb-b74a-3228e48f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909?artifact_id=c7b16f07-078b-4f71-8d61-93bbfaa4", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", + "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_fingerprint": "77bd283ca309eb2e7c88d8634ba19c66637c7030cae8129d6835cc4d450d742d", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:8e6b518@sha256:77bd283ca309eb2e7c88d8634ba19c66637c7030cae8129d6835cc4d450d742d", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "saver-2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", - "previous_template_reference_name": "saver" + "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_trail_name": "promotion-one-163", + "previous_template_reference_name": "languages-start-points" }, - "commit_lead_time": 593409.0, + "commit_lead_time": 3550101.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "saver", - "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "git_commit_info": { - "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "message": "Drop lone use of = separator on Kosli CLI boolean flag", - "author": "JonJagger ", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "template_reference_name": "languages-start-points", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "git_commit_info": { + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1785316994.0, - "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=ad8076c0-8b7e-47ac-b82a-2f2bb220", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909?artifact_id=8d6316ab-1e65-4138-8695-27110838", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:36f0420@sha256:2ec004d6e7c2668ff407b4384d6b4c62f92d9606ae18447c5fb326211921bc6a", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", - "previous_template_reference_name": "saver" + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "languages-start-points-28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", + "previous_template_reference_name": "languages-start-points" }, - "commit_lead_time": 2938402.0, + "commit_lead_time": -78560.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "saver-06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "template_reference_name": "saver", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "languages-start-points-040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "template_reference_name": "languages-start-points", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=91be21a4-68bf-4710-9f74-0c7a5ac5", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909?artifact_id=a5af66a8-baad-4d53-8da3-7f160ded", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:8c84fac@sha256:f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419", + "previous_fingerprint": "b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:7e86fed@sha256:b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "saver-f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419", - "previous_template_reference_name": "saver" + "previous_trail_name": "languages-start-points-b2f51324efc1528e4dda57d235bdbc68d966e1ea23722d5d296f98eefbfc2676", + "previous_template_reference_name": "languages-start-points" }, - "commit_lead_time": 593409.0, + "commit_lead_time": -78560.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/490f2bdcf1a2453db2a23395e26d2392", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/3654ae3b0ab3441e8826520bdebee1b4", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:bd3938c@sha256:aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -4425,24 +4429,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } }, @@ -4450,7 +4454,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } } @@ -4470,24 +4474,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } }, @@ -4495,7 +4499,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } } @@ -4506,10 +4510,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -4518,26 +4522,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } }, @@ -4545,14 +4549,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -4572,24 +4576,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } }, @@ -4597,7 +4601,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } } @@ -4617,24 +4621,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } }, @@ -4642,7 +4646,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } } @@ -4667,8 +4671,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -4676,8 +4680,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -4685,8 +4689,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -4695,7 +4699,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -4706,7 +4710,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -4723,24 +4727,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } }, @@ -4748,7 +4752,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } } @@ -4768,24 +4772,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } }, @@ -4793,7 +4797,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } } @@ -4804,60 +4808,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -4874,24 +4874,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } }, @@ -4899,7 +4899,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } } @@ -4919,24 +4919,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } }, @@ -4944,7 +4944,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } } @@ -4955,12 +4955,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -4969,39 +4969,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "artifact_status": null + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "artifact_status": null + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -5021,24 +5025,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } }, @@ -5046,7 +5050,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": null } } @@ -5072,24 +5076,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } }, @@ -5097,7 +5101,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "artifact_status": "COMPLIANT" } } @@ -5108,172 +5112,172 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "fingerprint": "aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "creationTimestamp": [ - 1788255396 + 1789022826 ], "pods": null, "annotation": { - "type": "updated-provenance", + "type": "unchanged", "was": 1, "now": 1 }, - "flow_name": "exercises-start-points-ci", - "git_commit": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=aa4300d4-b690-4d71-9596-6af987e1", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci", + "flow_name": "nginx-ci", + "git_commit": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "commit_url": "https://github.com/cyber-dojo/nginx/commit/bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5?artifact_id=30338133-ceb7-4976-8956-e0b140cf", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/exercises-start-points/compare/258b6d07d2b28ad5cb2ce6d29934997f72380f1a...f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "previous_git_commit": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a", - "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", + "diff_url": "https://github.com/cyber-dojo/nginx/compare/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65...bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "previous_git_commit": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "previous_fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/258b6d07d2b28ad5cb2ce6d29934997f72380f1a", - "previous_trail_name": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a", - "previous_template_reference_name": "exercises-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "previous_trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "previous_template_reference_name": "nginx" }, - "commit_lead_time": 416885.0, + "commit_lead_time": 981.0, "flows": [ { - "flow_name": "exercises-start-points-ci", - "trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "template_reference_name": "exercises-start-points", - "git_commit": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "flow_name": "nginx-ci", + "trail_name": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "template_reference_name": "nginx", + "git_commit": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "commit_url": "https://github.com/cyber-dojo/nginx/commit/bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "git_commit_info": { - "sha1": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "message": "Merge pull request #149 from cyber-dojo/update-base-image-ce45d62\n\nMerge update-base-image into main", + "sha1": "bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "message": "Merge pull request #171 from cyber-dojo/run-workflow-to-pickup-lib-updates\n\nRun workflow to pick up new snyk vuln fixes", "author": "Jon Jagger ", "branch": "", - "timestamp": 1787838511.0, - "url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8" + "timestamp": 1788866107.0, + "url": "https://github.com/cyber-dojo/nginx/commit/bd3938c88623bff4f02e1c2f12e97f7cd60523e3" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=aa4300d4-b690-4d71-9596-6af987e1", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci", + "html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5?artifact_id=30338133-ceb7-4976-8956-e0b140cf", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/nginx-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/exercises-start-points/compare/258b6d07d2b28ad5cb2ce6d29934997f72380f1a...f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", - "previous_git_commit": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a", - "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", + "diff_url": "https://github.com/cyber-dojo/nginx/compare/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65...bd3938c88623bff4f02e1c2f12e97f7cd60523e3", + "previous_git_commit": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "previous_fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/258b6d07d2b28ad5cb2ce6d29934997f72380f1a", - "previous_trail_name": "258b6d07d2b28ad5cb2ce6d29934997f72380f1a", - "previous_template_reference_name": "exercises-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/nginx/commit/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "previous_trail_name": "27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "previous_template_reference_name": "nginx" }, - "commit_lead_time": 416885.0, + "commit_lead_time": 981.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "template_reference_name": "exercises-start-points", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "template_reference_name": "nginx", + "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", + "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "message": "Drop lone use of = separator on Kosli CLI boolean flag", "author": "JonJagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1785316994.0, + "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=f0d94332-8b7c-4437-adf8-dc070a8e", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5?artifact_id=6054ab54-4c97-4a31-8dc1-6cd7f492", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", + "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "exercises-start-points-c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", - "previous_template_reference_name": "exercises-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_trail_name": "promote-all-34", + "previous_template_reference_name": "nginx" }, - "commit_lead_time": 593409.0, + "commit_lead_time": 3550094.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "exercises-start-points", - "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "template_reference_name": "nginx", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "message": "Drop lone use of = separator on Kosli CLI boolean flag", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1785316994.0, - "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=edc896a3-98a0-4cb0-8147-49fd6952", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5?artifact_id=6c3dc579-a9b1-413e-9738-5087e69c", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/81c216a55b2cb1787645e699ceaceca868cad253...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_git_commit": "81c216a55b2cb1787645e699ceaceca868cad253", - "previous_fingerprint": "c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:258b6d0@sha256:c7b7fd69d904329f9264e111bd3dc63cf98724cce567bae719e79a171e6925ea", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/81c216a55b2cb1787645e699ceaceca868cad253", - "previous_trail_name": "promote-all-31", - "previous_template_reference_name": "exercises-start-points" + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "nginx-1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "previous_template_reference_name": "nginx" }, - "commit_lead_time": 2938402.0, + "commit_lead_time": -78567.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "template_reference_name": "exercises-start-points", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "nginx-aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "template_reference_name": "nginx", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=601099dd-9069-4756-8c33-35cf65e1", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5?artifact_id=50bee95d-36db-441e-af26-4c0f1566", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:b8e5cbf@sha256:f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8", + "previous_fingerprint": "b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:7065268@sha256:b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "exercises-start-points-f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8", - "previous_template_reference_name": "exercises-start-points" + "previous_trail_name": "nginx-b7ff2cf22c934716a4280f0450ae52fe822cda7fce7fc5488bf62853860cddc8", + "previous_template_reference_name": "nginx" }, - "commit_lead_time": 593409.0, + "commit_lead_time": -78567.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/ca7755573c354bb191fc03f5496f0e7a", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/4dd7dd50d39444e68bc2bbea87eb0786", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:d01bb39@sha256:bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -5290,24 +5294,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } }, @@ -5315,7 +5319,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } } @@ -5335,24 +5339,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } }, @@ -5360,7 +5364,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } } @@ -5371,38 +5375,38 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } }, - "satisfied": null, - "ignored": true, + "satisfied": true, + "ignored": false, "resolutions": [ { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } }, @@ -5410,14 +5414,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -5437,24 +5441,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } }, @@ -5462,7 +5466,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } } @@ -5482,24 +5486,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } }, @@ -5507,7 +5511,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } } @@ -5526,14 +5530,14 @@ kosli get snapshot aws-prod --output=json "for_control": "SDLC-CTRL-0002" } }, - "satisfied": null, - "ignored": true, + "satisfied": true, + "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -5541,8 +5545,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -5550,8 +5554,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -5560,7 +5564,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -5571,7 +5575,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -5588,24 +5592,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } }, @@ -5613,7 +5617,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } } @@ -5633,24 +5637,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } }, @@ -5658,7 +5662,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } } @@ -5669,60 +5673,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -5739,24 +5739,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } }, @@ -5764,7 +5764,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } } @@ -5784,24 +5784,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } }, @@ -5809,7 +5809,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } } @@ -5820,12 +5820,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -5834,39 +5834,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "artifact_status": null + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "artifact_status": null + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -5886,24 +5890,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } }, @@ -5911,7 +5915,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": null } } @@ -5937,24 +5941,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } }, @@ -5962,7 +5966,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "artifact_status": "COMPLIANT" } } @@ -5973,100 +5977,69 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "fingerprint": "bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "creationTimestamp": [ - 1788255396 + 1789022822 ], "pods": null, "annotation": { - "type": "updated-provenance", + "type": "unchanged", "was": 1, "now": 1 }, - "flow_name": "spooler-ci", - "git_commit": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=6df79438-91a2-4c2b-a945-52fb5218", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci", + "flow_name": "exercises-start-points-ci", + "git_commit": "d01bb39495a1356eabe934bef84b92cc964a26f1", + "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/d01bb39495a1356eabe934bef84b92cc964a26f1", + "html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31?artifact_id=6884abdb-afdd-4c56-aa14-94e8da5c", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/spooler/compare/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb...90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "previous_git_commit": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb", - "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", + "diff_url": "https://github.com/cyber-dojo/exercises-start-points/compare/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8...d01bb39495a1356eabe934bef84b92cc964a26f1", + "previous_git_commit": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "previous_fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/spooler/commit/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb", - "previous_trail_name": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb", - "previous_template_reference_name": "spooler" + "previous_git_commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "previous_trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "previous_template_reference_name": "exercises-start-points" }, - "commit_lead_time": 352135.0, + "commit_lead_time": 6537.0, "flows": [ { - "flow_name": "spooler-ci", - "trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "template_reference_name": "spooler", - "git_commit": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "flow_name": "exercises-start-points-ci", + "trail_name": "d01bb39495a1356eabe934bef84b92cc964a26f1", + "template_reference_name": "exercises-start-points", + "git_commit": "d01bb39495a1356eabe934bef84b92cc964a26f1", + "commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/d01bb39495a1356eabe934bef84b92cc964a26f1", "git_commit_info": { - "sha1": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "message": "Merge pull request #18 from cyber-dojo/give-each-saver-forward-its-own-connection\n\nGive each saver forward its own http connection", + "sha1": "d01bb39495a1356eabe934bef84b92cc964a26f1", + "message": "Merge pull request #151 from cyber-dojo/update-base-image-a2388c1\n\nMerge update-base-image into main", "author": "Jon Jagger ", "branch": "", - "timestamp": 1787903261.0, - "url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f" - }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=6df79438-91a2-4c2b-a945-52fb5218", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci", - "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/spooler/compare/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb...90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", - "previous_git_commit": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb", - "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", - "previous_artifact_compliance_state": "COMPLIANT", - "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/spooler/commit/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb", - "previous_trail_name": "dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb", - "previous_template_reference_name": "spooler" - }, - "commit_lead_time": 352135.0, - "artifact_compliance_in_flow": true, - "flow_reasons_for_non_compliance": [] - }, - { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "template_reference_name": "spooler", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", - "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", - "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788860901.0, + "url": "https://github.com/cyber-dojo/exercises-start-points/commit/d01bb39495a1356eabe934bef84b92cc964a26f1" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=83b85760-e1f3-476b-9925-19541dee", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31?artifact_id=6884abdb-afdd-4c56-aa14-94e8da5c", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/10203d5d23f93844726f204390cf3d5ca8d5c913...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "10203d5d23f93844726f204390cf3d5ca8d5c913", - "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", + "diff_url": "https://github.com/cyber-dojo/exercises-start-points/compare/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8...d01bb39495a1356eabe934bef84b92cc964a26f1", + "previous_git_commit": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "previous_fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/10203d5d23f93844726f204390cf3d5ca8d5c913", - "previous_trail_name": "spooler-ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", - "previous_template_reference_name": "spooler" + "previous_git_commit_url": "https://github.com/cyber-dojo/exercises-start-points/commit/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "previous_trail_name": "f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "previous_template_reference_name": "exercises-start-points" }, - "commit_lead_time": 593409.0, + "commit_lead_time": 6537.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "spooler", + "trail_name": "promote-all-35", + "template_reference_name": "exercises-start-points", "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { @@ -6077,58 +6050,99 @@ kosli get snapshot aws-prod --output=json "timestamp": 1785316994.0, "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=fdd39323-ac61-4894-ae67-fc003bac", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31?artifact_id=d5da77dd-d12b-47e0-ac66-ef5e5a75", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:dc7dea2@sha256:ff871c3c8f4b5cfb60012bed1cd7f020b20f17fdabc2db0d8a5c77e75518fce0", + "previous_fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", - "previous_template_reference_name": "spooler" + "previous_trail_name": "promote-all-34", + "previous_template_reference_name": "exercises-start-points" + }, + "commit_lead_time": 3550444.0, + "artifact_compliance_in_flow": true, + "flow_reasons_for_non_compliance": [] + }, + { + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "template_reference_name": "exercises-start-points", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "git_commit_info": { + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", + "branch": "main", + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" + }, + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31?artifact_id=78955e83-729d-430a-9024-c86c519b", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "deployment_diff": { + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "previous_artifact_compliance_state": "COMPLIANT", + "previous_running": false, + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "exercises-start-points-41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "previous_template_reference_name": "exercises-start-points" }, - "commit_lead_time": 2938402.0, + "commit_lead_time": -78217.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "template_reference_name": "spooler", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "exercises-start-points-bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "template_reference_name": "exercises-start-points", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=24059058-ed02-4061-a4d1-b9a66269", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31?artifact_id=229c5332-8a88-4699-8e97-58d01849", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", - "deployment_diff": null, - "commit_lead_time": 593409.0, + "deployment_diff": { + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", + "previous_fingerprint": "f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:b8e5cbf@sha256:f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8", + "previous_artifact_compliance_state": "COMPLIANT", + "previous_running": false, + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", + "previous_trail_name": "exercises-start-points-f00aa234bebafb1980dced29626750f84a6fe6c9c50f6a90167e4d8e6511a8a8", + "previous_template_reference_name": "exercises-start-points" + }, + "commit_lead_time": -78217.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/61175d755bb64c5bba7130b854325414", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/ff1e094fcede458dbf94d752ad3bee18", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:5e4740c@sha256:9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -6145,24 +6159,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } }, @@ -6170,7 +6184,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } } @@ -6190,24 +6204,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } }, @@ -6215,7 +6229,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } } @@ -6226,10 +6240,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -6238,26 +6252,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } }, @@ -6265,14 +6279,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -6292,24 +6306,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } }, @@ -6317,7 +6331,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } } @@ -6337,24 +6351,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } }, @@ -6362,7 +6376,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } } @@ -6387,8 +6401,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -6396,8 +6410,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -6405,8 +6419,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -6415,7 +6429,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -6426,7 +6440,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -6443,24 +6457,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } }, @@ -6468,7 +6482,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } } @@ -6488,24 +6502,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } }, @@ -6513,7 +6527,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } } @@ -6524,60 +6538,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -6594,24 +6604,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } }, @@ -6619,7 +6629,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } } @@ -6639,24 +6649,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } }, @@ -6664,7 +6674,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } } @@ -6675,12 +6685,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -6689,39 +6699,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", - "artifact_status": null + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "artifact_status": null + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -6741,24 +6755,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } }, @@ -6766,7 +6780,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": null } } @@ -6792,24 +6806,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } }, @@ -6817,7 +6831,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "artifact_status": "COMPLIANT" } } @@ -6828,100 +6842,69 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "fingerprint": "9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", "creationTimestamp": [ - 1788255387 + 1789022819 ], "pods": null, "annotation": { - "type": "updated-provenance", + "type": "unchanged", "was": 1, "now": 1 }, - "flow_name": "dashboard-ci", - "git_commit": "ff9f292e809801d35246183988b7812826bc2760", - "commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760", - "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=aa6c0c1d-2d5d-4c98-9f9d-1160dd2f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci", + "flow_name": "spooler-ci", + "git_commit": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "commit_url": "https://github.com/cyber-dojo/spooler/commit/5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f?artifact_id=df1b0b8e-7efa-415e-860d-9123aa27", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/dashboard/compare/2b300f450f72006f6a9000aaf9cd04485f1e8095...ff9f292e809801d35246183988b7812826bc2760", - "previous_git_commit": "2b300f450f72006f6a9000aaf9cd04485f1e8095", - "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", + "diff_url": "https://github.com/cyber-dojo/spooler/compare/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f...5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "previous_git_commit": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "previous_fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/dashboard/commit/2b300f450f72006f6a9000aaf9cd04485f1e8095", - "previous_trail_name": "2b300f450f72006f6a9000aaf9cd04485f1e8095", - "previous_template_reference_name": "dashboard" + "previous_git_commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "previous_trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "previous_template_reference_name": "spooler" }, - "commit_lead_time": 413493.0, + "commit_lead_time": 89076.0, "flows": [ { - "flow_name": "dashboard-ci", - "trail_name": "ff9f292e809801d35246183988b7812826bc2760", - "template_reference_name": "dashboard", - "git_commit": "ff9f292e809801d35246183988b7812826bc2760", - "commit_url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760", + "flow_name": "spooler-ci", + "trail_name": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "template_reference_name": "spooler", + "git_commit": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "commit_url": "https://github.com/cyber-dojo/spooler/commit/5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "git_commit_info": { - "sha1": "ff9f292e809801d35246183988b7812826bc2760", - "message": "Use the simplecov 1.x spellings (#436)\n\n* Use the simplecov 1.x spellings\n\n The base image now carries simplecov 1.1.1 where it carried 0.21.2.\n Four spellings are deprecated there, each announcing itself on stderr on\n every run:\n\n add_group -> group\n add_filter -> skip\n # :nocov: -> # simplecov:disable / # simplecov:enable\n\n and the formatter reopened SimpleCov::Formatter::JSONFormatter to\n redefine format, which in 1.1.1 makes ruby -w report the redefinition.\n It is now CoverageMetricsFormatter, named for the coverage_metrics.json\n it writes. It never needed to be that class: what it produces is\n per-group totals, not the per-file shape the shipped formatter writes,\n so it was only borrowing the name to make itself win.\n\n The three :nocov: pairs are all in source, guarding the post methods\n that only the fixture scripts in test/scripts reach. The comment in\n create_v2_dashboard.rb naming those markers is renamed with them, so it\n still points at something that exists.\n\n source/client/Dockerfile was pinned to cyberdojo/sinatra-base:759c4e9 on\n Docker Hub, while everything else moved to ghcr.io. The automated\n base-image PR only rewrites the Dockerfile at the repo root, so that pin\n had gone unbumped long enough to be several ruby versions behind. It now\n names the same image as the root.\n\n That bump is unverified. The client tests cannot run: the client asks\n for hostname 'server' (source/client/code/external_dashboard.rb) and\n docker-compose.yml calls that service 'dashboard', so its healthcheck\n never resolves. Nothing noticed because no workflow runs them and the\n Makefile has no client target. Left as found, since dashboard is due to\n be merged into web.\n\n The group block parameter goes from the to path while passing.\n\n Coverage is unchanged: test.lines.total 644, code.lines.total 460,\n nothing missed in either.\n\n* Keep the simplecov markers inside the line length, and let rubocop cache\n\n simplecov:disable is seven characters longer than the :nocov: it\n replaced, which took three comment lines past 80 and failed the lint the\n previous commit had no reason to run. The prose those markers carried\n moves to its own line above them, so the marker line is only a marker\n and its length no longer depends on what is being explained.\n\n Separately, rubocop_lint.sh runs the container as the invoking uid,\n which has no entry in the container's /etc/passwd. HOME falls back to /,\n rubocop cannot create /.cache, and it says so once per file inspected -\n 35 lines of it here, and enough to bury the offences it is reporting.\n Naming a writable HOME lets it cache and say nothing.\n\n Neither changes what is inspected: 35 files, no offences, and the tests\n still report 50 runs with coverage on its limits at 644 and 460.", + "sha1": "5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "message": "Merge pull request #20 from cyber-dojo/update-base-image-949edc1\n\nMerge update-base-image into main", "author": "Jon Jagger ", "branch": "", - "timestamp": 1787841894.0, - "url": "https://github.com/cyber-dojo/dashboard/commit/ff9f292e809801d35246183988b7812826bc2760" - }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=aa6c0c1d-2d5d-4c98-9f9d-1160dd2f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci", - "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/dashboard/compare/2b300f450f72006f6a9000aaf9cd04485f1e8095...ff9f292e809801d35246183988b7812826bc2760", - "previous_git_commit": "2b300f450f72006f6a9000aaf9cd04485f1e8095", - "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", - "previous_artifact_compliance_state": "COMPLIANT", - "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/dashboard/commit/2b300f450f72006f6a9000aaf9cd04485f1e8095", - "previous_trail_name": "2b300f450f72006f6a9000aaf9cd04485f1e8095", - "previous_template_reference_name": "dashboard" - }, - "commit_lead_time": 413493.0, - "artifact_compliance_in_flow": true, - "flow_reasons_for_non_compliance": [] - }, - { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "template_reference_name": "dashboard", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", - "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", - "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788778354.0, + "url": "https://github.com/cyber-dojo/spooler/commit/5e4740c1146988f2e90cd2eb2fc6de0f8603e20a" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=07236a18-f9e6-440c-8163-89b30638", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f?artifact_id=df1b0b8e-7efa-415e-860d-9123aa27", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/spooler-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", + "diff_url": "https://github.com/cyber-dojo/spooler/compare/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f...5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", + "previous_git_commit": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "previous_fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "dashboard-1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", - "previous_template_reference_name": "dashboard" + "previous_git_commit_url": "https://github.com/cyber-dojo/spooler/commit/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "previous_trail_name": "90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "previous_template_reference_name": "spooler" }, - "commit_lead_time": 593400.0, + "commit_lead_time": 89076.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "dashboard", + "trail_name": "promote-all-35", + "template_reference_name": "spooler", "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { @@ -6932,68 +6915,89 @@ kosli get snapshot aws-prod --output=json "timestamp": 1785316994.0, "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=7d30bba6-9d58-403b-b6d8-efe3ebad", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f?artifact_id=fc124522-a5f3-403a-a97c-75cedd2a", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:2b300f4@sha256:1342e060fb8af6c34d004e474544d1472b940250eb0084f206c3d7bf9d78e2b5", + "previous_fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", - "previous_template_reference_name": "dashboard" + "previous_trail_name": "promote-all-34", + "previous_template_reference_name": "spooler" }, - "commit_lead_time": 2938393.0, + "commit_lead_time": 3550436.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "dashboard-2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "template_reference_name": "dashboard", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "template_reference_name": "spooler", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=95ee902d-ed5f-49ac-a772-a1ea0d78", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f?artifact_id=3b1ea734-03a4-471e-b9f5-f1125b84", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:87f560f@sha256:45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "dashboard-45513c642ba191052bde056d56eeba8b06b0346eb444ec0008bd59bc0581bb8c", - "previous_template_reference_name": "dashboard" + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "spooler-6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "previous_template_reference_name": "spooler" + }, + "commit_lead_time": -78225.0, + "artifact_compliance_in_flow": true, + "flow_reasons_for_non_compliance": [] + }, + { + "flow_name": "snyk-aws-prod-per-artifact", + "trail_name": "spooler-9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "template_reference_name": "spooler", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "git_commit_info": { + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", + "branch": "main", + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "commit_lead_time": 593400.0, + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f?artifact_id=83a46bf5-cc72-4dee-9f55-00c021c1", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", + "deployment_diff": null, + "commit_lead_time": -78225.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/f61e1822d26f4aa0a417417c3436c569", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/116f5564a14740798d58d386b69889b7", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:86c839e@sha256:ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -7010,8 +7014,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null } }, @@ -7019,7 +7023,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null } }, @@ -7027,7 +7031,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } }, @@ -7035,7 +7039,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } } @@ -7055,8 +7059,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": "COMPLIANT" } }, @@ -7064,7 +7068,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, @@ -7072,7 +7076,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } }, @@ -7080,7 +7084,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } } @@ -7091,10 +7095,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -7103,18 +7107,18 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null } }, @@ -7122,7 +7126,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } }, @@ -7130,14 +7134,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -7157,8 +7161,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null } }, @@ -7166,7 +7170,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null } }, @@ -7174,7 +7178,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } }, @@ -7182,7 +7186,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } } @@ -7202,8 +7206,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": "COMPLIANT" } }, @@ -7211,7 +7215,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, @@ -7219,7 +7223,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } }, @@ -7227,7 +7231,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } } @@ -7252,8 +7256,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -7262,7 +7266,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -7271,7 +7275,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -7280,7 +7284,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -7291,7 +7295,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -7308,8 +7312,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null } }, @@ -7317,7 +7321,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null } }, @@ -7325,7 +7329,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } }, @@ -7333,7 +7337,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } } @@ -7353,8 +7357,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": "COMPLIANT" } }, @@ -7362,7 +7366,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, @@ -7370,7 +7374,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } }, @@ -7378,7 +7382,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } } @@ -7389,60 +7393,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -7459,8 +7459,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null } }, @@ -7468,7 +7468,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null } }, @@ -7476,7 +7476,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } }, @@ -7484,7 +7484,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } } @@ -7504,8 +7504,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": "COMPLIANT" } }, @@ -7513,7 +7513,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, @@ -7521,7 +7521,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } }, @@ -7529,7 +7529,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } } @@ -7540,12 +7540,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -7554,39 +7554,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", - "artifact_status": null + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", - "artifact_status": null + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "artifact_status": null + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "artifact_status": null + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -7606,8 +7610,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": null } }, @@ -7615,7 +7619,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": null } }, @@ -7623,7 +7627,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } }, @@ -7631,7 +7635,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": null } } @@ -7657,8 +7661,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", "artifact_status": "COMPLIANT" } }, @@ -7666,7 +7670,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, @@ -7674,7 +7678,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } }, @@ -7682,7 +7686,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "artifact_status": "COMPLIANT" } } @@ -7693,71 +7697,69 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", + "fingerprint": "ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", "creationTimestamp": [ - 1788074885, - 1788074889, - 1788074889 + 1789022818 ], "pods": null, "annotation": { - "type": "updated-provenance", - "was": 3, - "now": 3 + "type": "unchanged", + "was": 1, + "now": 1 }, - "flow_name": "web-ci", - "git_commit": "cbe481c4b842f897e4e9e411cd78461a3a12a334", - "commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334", - "html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=41957e62-eaad-48d2-af40-46879efb", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci", + "flow_name": "custom-start-points-ci", + "git_commit": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e?artifact_id=60d0583d-4388-4a0a-925d-5b47d9a8", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/web/compare/5e4b9873df93525c041c386c06e0ab8fc36b6f33...cbe481c4b842f897e4e9e411cd78461a3a12a334", - "previous_git_commit": "5e4b9873df93525c041c386c06e0ab8fc36b6f33", - "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", + "diff_url": "https://github.com/cyber-dojo/custom-start-points/compare/b12a5c9b17023462d13e81381a69c7ef05f84dc2...86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "previous_git_commit": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "previous_fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/web/commit/5e4b9873df93525c041c386c06e0ab8fc36b6f33", - "previous_trail_name": "5e4b9873df93525c041c386c06e0ab8fc36b6f33", - "previous_template_reference_name": "web" + "previous_git_commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "previous_trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "previous_template_reference_name": "custom-start-points" }, - "commit_lead_time": 169904.0, + "commit_lead_time": 6352.0, "flows": [ { - "flow_name": "web-ci", - "trail_name": "cbe481c4b842f897e4e9e411cd78461a3a12a334", - "template_reference_name": "web", - "git_commit": "cbe481c4b842f897e4e9e411cd78461a3a12a334", - "commit_url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334", + "flow_name": "custom-start-points-ci", + "trail_name": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "template_reference_name": "custom-start-points", + "git_commit": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/86c839ee588f393d84a6b9c036478d10bb6f2a2d", "git_commit_info": { - "sha1": "cbe481c4b842f897e4e9e411cd78461a3a12a334", - "message": "Match the siblings on test-output buffering and frozen-string comments (#424)\n\nThe tee in the server test run makes ruby block-buffer stdout, so the\n progress dots only appeared once the whole run had finished. saver sets\n $stdout.sync in its own -e script for exactly this reason; web now does\n too.\n\n Every repo already freezes literals globally via RUBYOPT in up.sh, so a\n per-file magic comment buys nothing. runner, creator and differ exclude\n source/ from the cop, while web grandfathered each file in the todo\n instead, which is why the cop fired on the one newly added file.\n Excluding source/ matches them and leaves the todo holding only the bin/\n script that RUBYOPT does not reach.", + "sha1": "86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "message": "Merge pull request #145 from cyber-dojo/update-base-image-a2388c1\n\nMerge update-base-image into main", "author": "Jon Jagger ", "branch": "", - "timestamp": 1787904981.0, - "url": "https://github.com/cyber-dojo/web/commit/cbe481c4b842f897e4e9e411cd78461a3a12a334" + "timestamp": 1788860905.0, + "url": "https://github.com/cyber-dojo/custom-start-points/commit/86c839ee588f393d84a6b9c036478d10bb6f2a2d" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=41957e62-eaad-48d2-af40-46879efb", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/web-ci", + "html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e?artifact_id=60d0583d-4388-4a0a-925d-5b47d9a8", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/web/compare/5e4b9873df93525c041c386c06e0ab8fc36b6f33...cbe481c4b842f897e4e9e411cd78461a3a12a334", - "previous_git_commit": "5e4b9873df93525c041c386c06e0ab8fc36b6f33", - "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", + "diff_url": "https://github.com/cyber-dojo/custom-start-points/compare/b12a5c9b17023462d13e81381a69c7ef05f84dc2...86c839ee588f393d84a6b9c036478d10bb6f2a2d", + "previous_git_commit": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "previous_fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/web/commit/5e4b9873df93525c041c386c06e0ab8fc36b6f33", - "previous_trail_name": "5e4b9873df93525c041c386c06e0ab8fc36b6f33", - "previous_template_reference_name": "web" + "previous_git_commit_url": "https://github.com/cyber-dojo/custom-start-points/commit/b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "previous_trail_name": "b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "previous_template_reference_name": "custom-start-points" }, - "commit_lead_time": 169904.0, + "commit_lead_time": 6352.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "production-promotion", - "trail_name": "promotion-one-161", - "template_reference_name": "web", + "trail_name": "promote-all-35", + "template_reference_name": "custom-start-points", "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { @@ -7768,99 +7770,99 @@ kosli get snapshot aws-prod --output=json "timestamp": 1785316994.0, "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=3e754e79-8e4c-486a-ad94-0b183d32", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e?artifact_id=6fd3fc32-bd41-4fcc-8a19-d45ae3ba", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", + "previous_fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", - "previous_template_reference_name": "web" + "previous_trail_name": "promote-all-34", + "previous_template_reference_name": "custom-start-points" }, - "commit_lead_time": 2757891.0, + "commit_lead_time": 3550263.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "template_reference_name": "web", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "template_reference_name": "custom-start-points", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=14a0333a-7e59-454f-bcfa-f4c2e34b", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e?artifact_id=2a293eb4-5c35-4b7c-92d5-b32ca0ba", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:5e4b987@sha256:6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "web-6f394e0dccb59b852fa52ffa114fde8452280054c84de05b0627b1b0f18657bd", - "previous_template_reference_name": "web" + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "custom-start-points-34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "previous_template_reference_name": "custom-start-points" }, - "commit_lead_time": 412898.0, + "commit_lead_time": -78398.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "web-36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "template_reference_name": "web", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "trail_name": "custom-start-points-ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "template_reference_name": "custom-start-points", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=d7711381-757a-437c-9c77-55bcfd5f", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e?artifact_id=635c66c3-625f-44dd-98b0-d9906fa7", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_fingerprint": "29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:f66cc5c@sha256:29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4", + "previous_fingerprint": "b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:6b5c159@sha256:b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", - "previous_trail_name": "web-29c69c2f30f261a26fff4793fd8ae44b9081def1d4bcaaa27b0fef0501d949e4", - "previous_template_reference_name": "web" + "previous_trail_name": "custom-start-points-b4448ca68a0926e4a7a800f5b101b63e9c2f38e1caaebb7e929d992763570928", + "previous_template_reference_name": "custom-start-points" }, - "commit_lead_time": 412898.0, + "commit_lead_time": -78398.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/d68ae20a684745c6ba576ab68a51dd25", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/02b628eb907844948b7633bd9a68db2c", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:7c4708f@sha256:9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -7877,24 +7879,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } }, @@ -7902,7 +7904,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } } @@ -7922,24 +7924,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } }, @@ -7947,7 +7949,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } } @@ -7958,10 +7960,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -7970,26 +7972,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } }, @@ -7997,14 +7999,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -8024,24 +8026,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } }, @@ -8049,7 +8051,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } } @@ -8069,24 +8071,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } }, @@ -8094,7 +8096,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } } @@ -8119,8 +8121,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_satisfied", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -8128,8 +8130,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -8137,8 +8139,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -8147,7 +8149,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -8158,7 +8160,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -8175,24 +8177,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } }, @@ -8200,7 +8202,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } } @@ -8220,24 +8222,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } }, @@ -8245,7 +8247,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } } @@ -8256,60 +8258,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -8326,24 +8324,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } }, @@ -8351,7 +8349,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } } @@ -8371,24 +8369,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } }, @@ -8396,7 +8394,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } } @@ -8407,12 +8405,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -8421,39 +8419,43 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "artifact_status": null + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "artifact_status": null + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -8473,24 +8475,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } }, @@ -8498,7 +8500,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": null } } @@ -8524,24 +8526,24 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } }, @@ -8549,7 +8551,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "artifact_status": "COMPLIANT" } } @@ -8560,102 +8562,69 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", + "fingerprint": "9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "creationTimestamp": [ - 1788255749, - 1788255749, - 1788255844 + 1789022816 ], "pods": null, "annotation": { "type": "unchanged", - "was": 3, - "now": 3 + "was": 1, + "now": 1 }, - "flow_name": "runner-ci", - "git_commit": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=3b03ceaf-96a6-4afa-8aa2-179e5fe9", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci", + "flow_name": "saver-ci", + "git_commit": "7c4708f675a7717376529273ec32d08cd93f5c26", + "commit_url": "https://github.com/cyber-dojo/saver/commit/7c4708f675a7717376529273ec32d08cd93f5c26", + "html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc?artifact_id=326e1373-e805-48be-bfc7-6631db28", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/runner/compare/976b63e8001ec7441ebc7737ca69f620d47e7ffe...ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "previous_git_commit": "976b63e8001ec7441ebc7737ca69f620d47e7ffe", - "previous_fingerprint": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "previous_artifact_compliance_state": "COMPLIANT", - "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/runner/commit/976b63e8001ec7441ebc7737ca69f620d47e7ffe", - "previous_trail_name": "976b63e8001ec7441ebc7737ca69f620d47e7ffe", - "previous_template_reference_name": "runner" - }, - "commit_lead_time": 92169.0, - "flows": [ - { - "flow_name": "runner-ci", - "trail_name": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "template_reference_name": "runner", - "git_commit": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "commit_url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "git_commit_info": { - "sha1": "ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "message": "Keep the containers stderr empty (#306)\n\n* Run rm and truncate only when the walk finds files\n\n xargs runs its command once even when its input is empty, on GNU\n findutils and busybox alike. Most katas have no binary files and none\n over the size limit, so remove_binary_files and truncate_large_files\n each ran their command with no file operand and it answered with a\n usage error.\n\n That noise went to the container's own stderr, which is the daemon's\n second attach stream. The kata's stderr is a separate thing, arriving\n as tmp/stderr inside the payload, so nothing in the suite looked at\n the stream that carried it.\n\n --no-run-if-empty is the long form of the flag, and both userlands\n accept it, unlike xargs --null.\n\n* Give tar member names it has nothing to strip\n\n The payload's member names are relative: tmp/stdout, and sandbox/...\n for the kata's own files. runner.rb and Sandbox.out read them by those\n names. tar asked to archive an absolute path makes them relative\n itself, by stripping the leading /, and writes a warning about it to\n the container's stderr. Both tar calls in send_tgz() did that, two\n lines each, four on every test-run.\n\n --directory / hands tar names that are already relative to it, so it\n has nothing to strip and nothing to say. The member names are\n unchanged: GNU tar 1.35 in a language image writes the same list\n either way, tmp/stdout through sandbox/sub/b.txt.\n\n c9Gf21 now pins the whole of it, that the container's stderr is empty.\n That stream is the daemon's second attach stream, and separate from\n the kata's own stderr, which arrives as tmp/stderr inside the payload.", - "author": "Jon Jagger ", - "branch": "", - "timestamp": 1788163580.0, - "url": "https://github.com/cyber-dojo/runner/commit/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9" - }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=3b03ceaf-96a6-4afa-8aa2-179e5fe9", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/runner-ci", - "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/runner/compare/976b63e8001ec7441ebc7737ca69f620d47e7ffe...ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", - "previous_git_commit": "976b63e8001ec7441ebc7737ca69f620d47e7ffe", - "previous_fingerprint": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "previous_artifact_compliance_state": "COMPLIANT", - "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/runner/commit/976b63e8001ec7441ebc7737ca69f620d47e7ffe", - "previous_trail_name": "976b63e8001ec7441ebc7737ca69f620d47e7ffe", - "previous_template_reference_name": "runner" - }, - "commit_lead_time": 92169.0, - "artifact_compliance_in_flow": true, - "flow_reasons_for_non_compliance": [] - }, + "diff_url": "https://github.com/cyber-dojo/saver/compare/9030f8f46e738d94bd817727b8f8a9a54f106585...7c4708f675a7717376529273ec32d08cd93f5c26", + "previous_git_commit": "9030f8f46e738d94bd817727b8f8a9a54f106585", + "previous_fingerprint": "6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:9030f8f@sha256:6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", + "previous_artifact_compliance_state": "COMPLIANT", + "previous_running": false, + "previous_git_commit_url": "https://github.com/cyber-dojo/saver/commit/9030f8f46e738d94bd817727b8f8a9a54f106585", + "previous_trail_name": "9030f8f46e738d94bd817727b8f8a9a54f106585", + "previous_template_reference_name": "saver" + }, + "commit_lead_time": 89107.0, + "flows": [ { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "template_reference_name": "runner", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "flow_name": "saver-ci", + "trail_name": "7c4708f675a7717376529273ec32d08cd93f5c26", + "template_reference_name": "saver", + "git_commit": "7c4708f675a7717376529273ec32d08cd93f5c26", + "commit_url": "https://github.com/cyber-dojo/saver/commit/7c4708f675a7717376529273ec32d08cd93f5c26", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", - "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "sha1": "7c4708f675a7717376529273ec32d08cd93f5c26", + "message": "Dockerfile - Automated base-image update (#446)\n\nCo-authored-by: JonJagger ", + "author": "Jon Jagger ", + "branch": "", + "timestamp": 1788778339.0, + "url": "https://github.com/cyber-dojo/saver/commit/7c4708f675a7717376529273ec32d08cd93f5c26" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=e9d1f562-ed75-4e9a-ac28-18bdf67f", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc?artifact_id=326e1373-e805-48be-bfc7-6631db28", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/saver-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ad256a36cfd9d90f78acbf393e4bff5a2ef45fcf...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "ad256a36cfd9d90f78acbf393e4bff5a2ef45fcf", - "previous_fingerprint": "fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:d7541d3@sha256:fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", + "diff_url": "https://github.com/cyber-dojo/saver/compare/9030f8f46e738d94bd817727b8f8a9a54f106585...7c4708f675a7717376529273ec32d08cd93f5c26", + "previous_git_commit": "9030f8f46e738d94bd817727b8f8a9a54f106585", + "previous_fingerprint": "6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:9030f8f@sha256:6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ad256a36cfd9d90f78acbf393e4bff5a2ef45fcf", - "previous_trail_name": "runner-fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", - "previous_template_reference_name": "runner" + "previous_git_commit_url": "https://github.com/cyber-dojo/saver/commit/9030f8f46e738d94bd817727b8f8a9a54f106585", + "previous_trail_name": "9030f8f46e738d94bd817727b8f8a9a54f106585", + "previous_template_reference_name": "saver" }, - "commit_lead_time": 593762.0, + "commit_lead_time": 89107.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "template_reference_name": "runner", + "trail_name": "promote-all-35", + "template_reference_name": "saver", "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { @@ -8666,68 +8635,99 @@ kosli get snapshot aws-prod --output=json "timestamp": 1785316994.0, "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=95170cfc-5215-420d-a2b0-83fee5dc", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc?artifact_id=8fb8e719-d3c3-41e3-8c3d-330a1bf8", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", + "previous_fingerprint": "6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:9030f8f@sha256:6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promotion-one-160", - "previous_template_reference_name": "runner" + "previous_trail_name": "promotion-one-162", + "previous_template_reference_name": "saver" }, - "commit_lead_time": 2938755.0, + "commit_lead_time": 3550452.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "runner-a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "template_reference_name": "runner", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "template_reference_name": "saver", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=d21568bf-b02a-4532-a725-6fc824a6", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc?artifact_id=01d2ba7c-c06f-40a8-8dfc-5b71d5f9", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_fingerprint": "fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:d7541d3@sha256:fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", + "previous_fingerprint": "6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:9030f8f@sha256:6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_trail_name": "runner-fd8c68c615a68bfa49569beea07d071950dcfeac676028543f530dd7193f5631", - "previous_template_reference_name": "runner" + "previous_trail_name": "saver-6f6be2c6ce42d0d96b320f84f6bd8cbf6f22fc01b8f32fda047f682494c1c733", + "previous_template_reference_name": "saver" + }, + "commit_lead_time": -78209.0, + "artifact_compliance_in_flow": true, + "flow_reasons_for_non_compliance": [] + }, + { + "flow_name": "snyk-aws-prod-per-artifact", + "trail_name": "saver-9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "template_reference_name": "saver", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "git_commit_info": { + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", + "branch": "main", + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" + }, + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc?artifact_id=f91367c3-bdd4-4f8c-89df-7ebad571", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", + "deployment_diff": { + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", + "previous_fingerprint": "f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:8c84fac@sha256:f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419", + "previous_artifact_compliance_state": "COMPLIANT", + "previous_running": false, + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/00c479764cb9eca038fdaaaef108672d0bb0ed26", + "previous_trail_name": "saver-f5909cc8dd53b2105953d1a72cd5d6181367d3588964aa01a04c056205a5d419", + "previous_template_reference_name": "saver" }, - "commit_lead_time": 593762.0, + "commit_lead_time": -78209.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/a8c4fce1500343aa9d5dd37759266af8", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/89078662eaed4dce813ab87e8faac4af", "cluster_name": null, "service_name": null } }, { - "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:2e9bd96@sha256:f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "compliant": true, "deployments": [], "policy_decisions": [ { - "policy_version": 3, + "policy_version": 2, "status": "COMPLIANT", "rule_evaluations": [ { @@ -8745,23 +8745,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } }, @@ -8769,7 +8769,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } } @@ -8790,23 +8790,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } }, @@ -8814,7 +8814,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } } @@ -8825,10 +8825,10 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -8837,26 +8837,26 @@ kosli get snapshot aws-prod --output=json "ignored": false, "resolutions": [ { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } }, @@ -8864,14 +8864,14 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } } ] } ], - "policy_name": "pull-request" + "policy_name": "production-promotion" }, { "policy_version": 3, @@ -8892,23 +8892,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_satisfied", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } }, @@ -8916,7 +8916,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } } @@ -8937,23 +8937,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } }, @@ -8961,7 +8961,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } } @@ -8987,7 +8987,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -8995,8 +8995,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -9004,8 +9004,8 @@ kosli get snapshot aws-prod --output=json { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -9014,7 +9014,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null, "for_control": "SDLC-CTRL-0002" } @@ -9025,7 +9025,7 @@ kosli get snapshot aws-prod --output=json "policy_name": "provenance" }, { - "policy_version": 4, + "policy_version": 3, "status": "COMPLIANT", "rule_evaluations": [ { @@ -9043,23 +9043,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } }, @@ -9067,7 +9067,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } } @@ -9088,23 +9088,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } }, @@ -9112,7 +9112,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } } @@ -9123,60 +9123,56 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } }, "satisfied": true, "ignored": false, "resolutions": [ { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "artifact_status": null } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "artifact_status": null, - "for_control": "SDLC-CTRL-0022" + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "artifact_status": null } } ] } ], - "policy_name": "snyk-scan-aws-prod" + "policy_name": "pull-request" }, { - "policy_version": 2, + "policy_version": 4, "status": "COMPLIANT", "rule_evaluations": [ { @@ -9194,23 +9190,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } }, @@ -9218,7 +9214,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } } @@ -9239,23 +9235,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } }, @@ -9263,7 +9259,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } } @@ -9274,12 +9270,12 @@ kosli get snapshot aws-prod --output=json "type": "attestation", "definition": { "if": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } }, "satisfied": true, @@ -9289,38 +9285,42 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "artifact_status": null + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "artifact_status": null + "flow_name": "production-promotion", + "trail_name": "promote-all-35", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", - "artifact_status": null + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "artifact_status": null + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "artifact_status": null, + "for_control": "SDLC-CTRL-0022" } } ] } ], - "policy_name": "production-promotion" + "policy_name": "snyk-scan-aws-prod" }, { "policy_version": 2, @@ -9341,23 +9341,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": null } }, { "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } }, @@ -9365,7 +9365,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": null } } @@ -9392,23 +9392,23 @@ kosli get snapshot aws-prod --output=json "type": "rule_not_applicable", "context": { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "artifact_status": "COMPLIANT" } }, { - "type": "rule_not_applicable", + "type": "rule_satisfied", "context": { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "artifact_status": "COMPLIANT" } }, { - "type": "rule_satisfied", + "type": "rule_not_applicable", "context": { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } }, @@ -9416,7 +9416,7 @@ kosli get snapshot aws-prod --output=json "type": "rule_satisfied", "context": { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "artifact_status": "COMPLIANT" } } @@ -9427,9 +9427,9 @@ kosli get snapshot aws-prod --output=json } ], "reasons_for_incompliance": [], - "fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "fingerprint": "f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "creationTimestamp": [ - 1788255749 + 1789022811 ], "pods": null, "annotation": { @@ -9438,134 +9438,134 @@ kosli get snapshot aws-prod --output=json "now": 1 }, "flow_name": "differ-ci", - "git_commit": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=11345222-f37a-4f8d-8051-ec26a321", + "git_commit": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "commit_url": "https://github.com/cyber-dojo/differ/commit/2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409?artifact_id=054eef05-3aee-49ae-9e4d-55f768b7", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/differ/compare/108cccf9bccf9af5d455db66c250480b53cbecc7...bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "previous_git_commit": "108cccf9bccf9af5d455db66c250480b53cbecc7", - "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", + "diff_url": "https://github.com/cyber-dojo/differ/compare/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de...2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "previous_git_commit": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "previous_fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/differ/commit/108cccf9bccf9af5d455db66c250480b53cbecc7", - "previous_trail_name": "108cccf9bccf9af5d455db66c250480b53cbecc7", + "previous_git_commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "previous_trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", "previous_template_reference_name": "differ" }, - "commit_lead_time": 5862.0, + "commit_lead_time": 88615.0, "flows": [ { "flow_name": "differ-ci", - "trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "trail_name": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "template_reference_name": "differ", - "git_commit": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "git_commit": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "commit_url": "https://github.com/cyber-dojo/differ/commit/2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "git_commit_info": { - "sha1": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "message": "Rerun workflow to see if it fixes sonar flake (#469)", + "sha1": "2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "message": "Dockerfile - Automated base-image update (#474)\n\nCo-authored-by: JonJagger ", "author": "Jon Jagger ", "branch": "", - "timestamp": 1788249887.0, - "url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de" + "timestamp": 1788778834.0, + "url": "https://github.com/cyber-dojo/differ/commit/2e9bd969b50fff6b86578d69b7139f2d688ef6e2" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=11345222-f37a-4f8d-8051-ec26a321", + "html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409?artifact_id=054eef05-3aee-49ae-9e4d-55f768b7", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/differ-ci", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/differ/compare/108cccf9bccf9af5d455db66c250480b53cbecc7...bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", - "previous_git_commit": "108cccf9bccf9af5d455db66c250480b53cbecc7", - "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", + "diff_url": "https://github.com/cyber-dojo/differ/compare/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de...2e9bd969b50fff6b86578d69b7139f2d688ef6e2", + "previous_git_commit": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "previous_fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/differ/commit/108cccf9bccf9af5d455db66c250480b53cbecc7", - "previous_trail_name": "108cccf9bccf9af5d455db66c250480b53cbecc7", + "previous_git_commit_url": "https://github.com/cyber-dojo/differ/commit/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "previous_trail_name": "bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", "previous_template_reference_name": "differ" }, - "commit_lead_time": 5862.0, + "commit_lead_time": 88615.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "snyk-aws-beta-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "flow_name": "production-promotion", + "trail_name": "promote-all-35", "template_reference_name": "differ", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", + "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "message": "Drop lone use of = separator on Kosli CLI boolean flag", "author": "JonJagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1785316994.0, + "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=c19121c7-2115-4fe0-b472-1d4ea833", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", + "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409?artifact_id=516eb6d4-9435-429b-87f2-51edb16f", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/c0666c020044ac5b5181999ec153db1e7f6cd303...ed3c81d7322bb8058615095f4aab28c147c53933", - "previous_git_commit": "c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", + "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/c0666c020044ac5b5181999ec153db1e7f6cd303", - "previous_trail_name": "differ-31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", + "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "previous_trail_name": "promote-all-34", "previous_template_reference_name": "differ" }, - "commit_lead_time": 593762.0, + "commit_lead_time": 3550455.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { - "flow_name": "production-promotion", - "trail_name": "promote-all-34", + "flow_name": "snyk-aws-beta-per-artifact", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "template_reference_name": "differ", - "git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "message": "Drop lone use of = separator on Kosli CLI boolean flag", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1785316994.0, - "url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=868b85f5-e442-42ac-9474-0cbb1ab3", - "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/production-promotion", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact/artifacts/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409?artifact_id=9fc7c402-1e99-4822-a233-50a7becb", + "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-beta-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/compare/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584...7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_git_commit": "7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_fingerprint": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/ed3c81d7322bb8058615095f4aab28c147c53933...30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "previous_git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_fingerprint": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", "previous_artifact_compliance_state": "COMPLIANT", "previous_running": false, - "previous_git_commit_url": "https://github.com/cyber-dojo/aws-prod-co-promotion/commit/7494758f8bbc4e66cb5df90ef4cd6b72d75ca584", - "previous_trail_name": "promote-all-33", + "previous_git_commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "previous_trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", "previous_template_reference_name": "differ" }, - "commit_lead_time": 2938755.0, + "commit_lead_time": -78206.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] }, { "flow_name": "snyk-aws-prod-per-artifact", - "trail_name": "differ-03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", + "trail_name": "differ-f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", "template_reference_name": "differ", - "git_commit": "ed3c81d7322bb8058615095f4aab28c147c53933", - "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933", + "git_commit": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "commit_url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff", "git_commit_info": { - "sha1": "ed3c81d7322bb8058615095f4aab28c147c53933", - "message": "Unpack one pinned commit instead of fetching each file\n\n a0c005a moved these two jobs' files to RUNNER_TEMP, which kept them out of\n the caller's checkout but left the prefix repeated at every use. The paths\n are absolute because the run steps stay in the checkout, where the Kosli\n CLI reads git commit information from the working directory, so the prefix\n cannot be dropped. It can only be folded into the definitions, and a\n literal /tmp folds where runner.temp does not: the runner context is\n unavailable in workflow- and job-level env blocks. Both jobs are pinned to\n ubuntu-latest, one fresh VM per job, so /tmp neither collides nor persists.\n\n The files also arrived as five separate fetches of main, one per file, so a\n push landing mid-run could pair a rego policy with params from a different\n commit. find-snyk-vulns already checks this repo out, so it now publishes\n the SHA it resolved, and the two later jobs unpack that exact commit as a\n single tarball. One run reads one version.\n\n An env-var's prefix now says where its file came from: SNYK_SCANNING_ from\n this repo at the pinned commit, CALLER_ from the repo being scanned, TMP_\n produced by the run. That split is worth naming because only one of these\n files is the caller's, and it is the one .snyk that the decision attests\n against. Two bare filenames survive because an artifact name cannot\n contain a '/'.\n\n fetch-url-to-file now has exactly one caller, for that .snyk.", - "author": "JonJagger ", + "sha1": "30111f180ac4e3611cdbd7d805381a0bb9f53cff", + "message": "Merge pull request #4 from cyber-dojo/take-both-age-instants-from-one-trail-read\n\nMeasure a vuln's age on the Kosli server's clock alone", + "author": "Jon Jagger ", "branch": "main", - "timestamp": 1787661987.0, - "url": "https://github.com/cyber-dojo/snyk-scanning/commit/ed3c81d7322bb8058615095f4aab28c147c53933" + "timestamp": 1788945655.0, + "url": "https://github.com/cyber-dojo/snyk-scanning/commit/30111f180ac4e3611cdbd7d805381a0bb9f53cff" }, - "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=d014796c-e7b5-4b48-92f7-99ec7f8f", + "html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact/artifacts/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409?artifact_id=47b639ae-b6f8-446f-a5e0-d78cde5e", "flow_html_url": "https://app.kosli.com/cyber-dojo/flows/snyk-aws-prod-per-artifact", "deployment_diff": { - "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...ed3c81d7322bb8058615095f4aab28c147c53933", + "diff_url": "https://github.com/cyber-dojo/snyk-scanning/compare/00c479764cb9eca038fdaaaef108672d0bb0ed26...30111f180ac4e3611cdbd7d805381a0bb9f53cff", "previous_git_commit": "00c479764cb9eca038fdaaaef108672d0bb0ed26", "previous_fingerprint": "902ec7af03407049ac6e5ef713146d518bbffd9d99cd28715fa0df973e809b7b", "previous_artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:981dcfc@sha256:902ec7af03407049ac6e5ef713146d518bbffd9d99cd28715fa0df973e809b7b", @@ -9575,13 +9575,13 @@ kosli get snapshot aws-prod --output=json "previous_trail_name": "differ-902ec7af03407049ac6e5ef713146d518bbffd9d99cd28715fa0df973e809b7b", "previous_template_reference_name": "differ" }, - "commit_lead_time": 593762.0, + "commit_lead_time": -78206.0, "artifact_compliance_in_flow": true, "flow_reasons_for_non_compliance": [] } ], "ecs_context": { - "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/2e9f021f4b484d48a46dc90a3b172b31", + "task_arn": "arn:aws:ecs:eu-central-1:274425519734:task/app/796c685a73274536b400dd72e3dea728", "cluster_name": null, "service_name": null } @@ -9589,9 +9589,9 @@ kosli get snapshot aws-prod --output=json ], "applied_policies": [ { - "id": "0b0c4d5a-cc1f-4725-8f97-af256289", - "name": "pull-request", - "version": 3, + "id": "bdb8a802-a406-4c76-b289-3fe30be3", + "name": "production-promotion", + "version": 2, "policy_dump": { "schema_version": "1", "artifacts": { @@ -9606,10 +9606,10 @@ kosli get snapshot aws-prod --output=json "attestations": [ { "if_condition": { - "text": "flow.tags.kind == \"build\"" + "text": "flow.name == \"production-promotion\"" }, - "name": "*", - "type": "pull_request", + "name": "snyk-scan", + "type": "decision", "must_be_compliant": true, "for_control": null } @@ -9649,9 +9649,9 @@ kosli get snapshot aws-prod --output=json "failing_artifacts": [] }, { - "id": "93d8505f-bce5-4c7c-a2c8-f98236c8", - "name": "snyk-scan-aws-prod", - "version": 4, + "id": "0b0c4d5a-cc1f-4725-8f97-af256289", + "name": "pull-request", + "version": 3, "policy_dump": { "schema_version": "1", "artifacts": { @@ -9666,12 +9666,12 @@ kosli get snapshot aws-prod --output=json "attestations": [ { "if_condition": { - "text": "flow.name == \"snyk-aws-prod-per-artifact\"" + "text": "flow.tags.kind == \"build\"" }, - "name": "snyk-container-scan", - "type": "decision", + "name": "*", + "type": "pull_request", "must_be_compliant": true, - "for_control": "SDLC-CTRL-0022" + "for_control": null } ] } @@ -9679,9 +9679,9 @@ kosli get snapshot aws-prod --output=json "failing_artifacts": [] }, { - "id": "bdb8a802-a406-4c76-b289-3fe30be3", - "name": "production-promotion", - "version": 2, + "id": "93d8505f-bce5-4c7c-a2c8-f98236c8", + "name": "snyk-scan-aws-prod", + "version": 4, "policy_dump": { "schema_version": "1", "artifacts": { @@ -9696,12 +9696,12 @@ kosli get snapshot aws-prod --output=json "attestations": [ { "if_condition": { - "text": "flow.name == \"production-promotion\"" + "text": "flow.name == \"snyk-aws-prod-per-artifact\"" }, - "name": "snyk-scan", + "name": "snyk-container-scan", "type": "decision", "must_be_compliant": true, - "for_control": null + "for_control": "SDLC-CTRL-0022" } ] } diff --git a/client_reference/kosli_get_trail.md b/client_reference/kosli_get_trail.md index af1188b6..70769c08 100644 --- a/client_reference/kosli_get_trail.md +++ b/client_reference/kosli_get_trail.md @@ -23,7 +23,7 @@ Get the metadata of a specific trail. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_join_environment.md b/client_reference/kosli_join_environment.md index cb508883..772857c4 100644 --- a/client_reference/kosli_join_environment.md +++ b/client_reference/kosli_join_environment.md @@ -24,7 +24,7 @@ Join a physical environment to a logical environment. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_api-keys.md b/client_reference/kosli_list_api-keys.md index 18845763..6ed9ff87 100644 --- a/client_reference/kosli_list_api-keys.md +++ b/client_reference/kosli_list_api-keys.md @@ -26,7 +26,7 @@ listed (they are only shown once, at creation or rotation time). | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_artifacts.md b/client_reference/kosli_list_artifacts.md index 0d6fdcad..6f6f9610 100644 --- a/client_reference/kosli_list_artifacts.md +++ b/client_reference/kosli_list_artifacts.md @@ -28,7 +28,7 @@ By default, the page limit is 15 artifacts per page. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_attestation-types.md b/client_reference/kosli_list_attestation-types.md index 257b91d3..18b575bb 100644 --- a/client_reference/kosli_list_attestation-types.md +++ b/client_reference/kosli_list_attestation-types.md @@ -22,7 +22,7 @@ List all Kosli attestation types for an org. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_controls.md b/client_reference/kosli_list_controls.md index 5d58f2eb..565fbfcf 100644 --- a/client_reference/kosli_list_controls.md +++ b/client_reference/kosli_list_controls.md @@ -34,7 +34,7 @@ The results are paginated; use --page and --page-limit to navigate the pages. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_environments.md b/client_reference/kosli_list_environments.md index e9f381db..ea2181ed 100644 --- a/client_reference/kosli_list_environments.md +++ b/client_reference/kosli_list_environments.md @@ -33,7 +33,7 @@ The list can be filtered by name, type, space and tags, and sorted with --sort a | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -63,9 +63,9 @@ kosli list environments --output=json "name": "aws-beta", "type": "ECS", "description": "The ECS cluster for staging cyber-dojo", - "last_modified_at": 1788260423.8795948, - "last_reported_at": 1788260423.8795948, - "last_changed_at": 1788256284.0239065, + "last_modified_at": 1789114043.9935918, + "last_reported_at": 1789114043.9935918, + "last_changed_at": 1789113443.9263997, "state": true, "include_scaling": false, "tags": { @@ -84,9 +84,9 @@ kosli list environments --output=json "name": "aws-beta-terraform-drift-detection", "type": "server", "description": "Detection of drift of the Infrastructure-as-code components of aws-beta", - "last_modified_at": 1788260408.588247, - "last_reported_at": 1788260408.588247, - "last_changed_at": 1788254708.6300995, + "last_modified_at": 1789113909.1972687, + "last_reported_at": 1789113909.1972687, + "last_changed_at": 1789113909.1972687, "state": true, "include_scaling": false, "tags": {}, @@ -100,9 +100,9 @@ kosli list environments --output=json "name": "aws-prod", "type": "ECS", "description": "The ECS cluster for production cyber-dojo", - "last_modified_at": 1788260398.5436597, - "last_reported_at": 1788260398.5436597, - "last_changed_at": 1788256325.6192138, + "last_modified_at": 1789114018.585112, + "last_reported_at": 1789114018.585112, + "last_changed_at": 1789108858.5535865, "state": true, "include_scaling": false, "tags": { @@ -122,9 +122,9 @@ kosli list environments --output=json "name": "aws-prod-terraform-drift-detection", "type": "server", "description": "Detection of drift of the Infrastructure-as-code components of aws-prod", - "last_modified_at": 1788260312.0991778, - "last_reported_at": 1788260312.0991778, - "last_changed_at": 1788256412.1366148, + "last_modified_at": 1789113812.7967694, + "last_reported_at": 1789113812.7967694, + "last_changed_at": 1789033111.9033823, "state": true, "include_scaling": false, "tags": {}, @@ -138,9 +138,9 @@ kosli list environments --output=json "name": "production", "type": "logical", "description": "Production environments for cyber-dojo", - "last_modified_at": 1788256412.1366148, + "last_modified_at": 1789108858.5535865, "last_reported_at": null, - "last_changed_at": 1788256412.1366148, + "last_changed_at": 1789108858.5535865, "state": true, "include_scaling": false, "tags": {}, @@ -155,9 +155,9 @@ kosli list environments --output=json "name": "staging", "type": "logical", "description": "Staging environments for cyber-dojo", - "last_modified_at": 1788256284.0239065, + "last_modified_at": 1789113909.1972687, "last_reported_at": null, - "last_changed_at": 1788256284.0239065, + "last_changed_at": 1789113909.1972687, "state": true, "include_scaling": false, "tags": {}, diff --git a/client_reference/kosli_list_flows.md b/client_reference/kosli_list_flows.md index 5b82404f..5d526a5b 100644 --- a/client_reference/kosli_list_flows.md +++ b/client_reference/kosli_list_flows.md @@ -29,7 +29,7 @@ The list can be filtered by name with --name (and --ignore-case for case-insensi | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -68,7 +68,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788256138.680238, + "latest_activity_at": 1789023418.5988352, "latest_state": "COMPLIANT" }, { @@ -85,7 +85,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255478.4228623, + "latest_activity_at": 1789022818.5234735, "latest_state": "COMPLIANT" }, { @@ -102,7 +102,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255478.4228623, + "latest_activity_at": 1789022878.756657, "latest_state": "COMPLIANT" }, { @@ -119,7 +119,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255838.4418423, + "latest_activity_at": 1789022818.5234735, "latest_state": "COMPLIANT" }, { @@ -136,7 +136,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255478.4228623, + "latest_activity_at": 1789022878.756657, "latest_state": "COMPLIANT" }, { @@ -153,7 +153,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255838.4418423, + "latest_activity_at": 1789113443.9263997, "latest_state": "COMPLIANT" }, { @@ -218,7 +218,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255838.4418423, + "latest_activity_at": 1789022878.756657, "latest_state": "COMPLIANT" }, { @@ -227,7 +227,7 @@ kosli list flows --output=json "description": "Promotes sets of Artifacts from aws-beta to aws-prod", "visibility": "private", "org": "cyber-dojo", - "template": "version: 1\n\ntrail:\n attestations:\n - name: all-promotions\n type: generic\n", + "template": "version: 1\n\ntrail:\n attestations:\n - name: one-promotion\n type: generic\n", "repo_url": "https://github.com/cyber-dojo/aws-prod-co-promotion", "tags": { "ci": "github", @@ -235,7 +235,7 @@ kosli list flows --output=json "kind": "release", "env": "aws-prod" }, - "latest_activity_at": 1788254949.8226013, + "latest_activity_at": 1789023183.9163306, "latest_state": "COMPLIANT" }, { @@ -264,7 +264,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255898.5005004, + "latest_activity_at": 1789022878.756657, "latest_state": "COMPLIANT" }, { @@ -281,7 +281,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788255478.4228623, + "latest_activity_at": 1789022818.5234735, "latest_state": "COMPLIANT" }, { @@ -297,7 +297,7 @@ kosli list flows --output=json "kind": "run", "repo_url": "https://github.com/cyber-dojo/secrets" }, - "latest_activity_at": 1788249204.33249, + "latest_activity_at": 1789111286.9981027, "latest_state": "NON-COMPLIANT" }, { @@ -314,7 +314,7 @@ kosli list flows --output=json "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/aws-beta.yml", "env": "aws-beta" }, - "latest_activity_at": 1788254744.4473586, + "latest_activity_at": 1789108765.4501896, "latest_state": "COMPLIANT" }, { @@ -331,7 +331,7 @@ kosli list flows --output=json "kind": "run", "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/artifact_snyk_test.yml" }, - "latest_activity_at": 1788252975.2436972, + "latest_activity_at": 1788849399.3254054, "latest_state": "COMPLIANT" }, { @@ -348,7 +348,7 @@ kosli list flows --output=json "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/aws-prod.yml", "env": "aws-prod" }, - "latest_activity_at": 1788256311.5220706, + "latest_activity_at": 1789108810.121742, "latest_state": "COMPLIANT" }, { @@ -365,7 +365,7 @@ kosli list flows --output=json "kind": "run", "workflow_url": "https://github.com/cyber-dojo/snyk-scanning/blob/main/.github/workflows/artifact_snyk_test.yml" }, - "latest_activity_at": 1788256281.9068878, + "latest_activity_at": 1788849388.1978226, "latest_state": "COMPLIANT" }, { @@ -377,9 +377,12 @@ kosli list flows --output=json "template": "version: 1\n\ntrail:\n attestations:\n - name: pull-request\n type: pull_request\n artifacts:\n - name: spooler\n attestations:\n - name: provenance-facts\n type: custom:provenance-facts\n - name: provenance-decision\n type: decision\n\n - name: sbom-facts\n type: custom:sbom-facts\n - name: sbom-decision\n type: decision\n\n - name: snyk-container-scan\n type: decision\n\n - name: unit-test\n type: junit\n - name: unit-test-metrics\n type: custom:test-metrics\n - name: unit-test-coverage-metrics\n type: custom:coverage-metrics\n - name: integration-test\n type: junit\n - name: integration-test-metrics\n type: custom:test-metrics\n - name: integration-test-coverage-metrics\n type: custom:coverage-metrics\n", "repo_url": "https://github.com/cyber-dojo/spooler", "tags": { - "env": "aws-beta" + "env": "aws-beta", + "ci": "github", + "kind": "build", + "url": "https://github.com/cyber-dojo/spooler" }, - "latest_activity_at": 1788255478.4228623, + "latest_activity_at": 1789022878.756657, "latest_state": "COMPLIANT" }, { @@ -391,7 +394,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/creator", "tags": {}, - "latest_activity_at": 1787836208.8569806, + "latest_activity_at": 1789020610.394908, "latest_state": "COMPLIANT" }, { @@ -403,7 +406,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/custom-start-points", "tags": {}, - "latest_activity_at": 1787839208.4459617, + "latest_activity_at": 1788966908.7169383, "latest_state": "COMPLIANT" }, { @@ -415,7 +418,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/dashboard", "tags": {}, - "latest_activity_at": 1787843108.7875247, + "latest_activity_at": 1788966908.7169383, "latest_state": "COMPLIANT" }, { @@ -427,7 +430,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/differ", "tags": {}, - "latest_activity_at": 1788250508.7286773, + "latest_activity_at": 1788979508.704252, "latest_state": "COMPLIANT" }, { @@ -439,7 +442,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/exercises-start-points", "tags": {}, - "latest_activity_at": 1787839208.4459617, + "latest_activity_at": 1788966908.7169383, "latest_state": "COMPLIANT" }, { @@ -451,7 +454,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/languages-start-points", "tags": {}, - "latest_activity_at": 1788246608.7289636, + "latest_activity_at": 1789113909.1972687, "latest_state": "COMPLIANT" }, { @@ -463,7 +466,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/nginx", "tags": {}, - "latest_activity_at": 1788254708.6300995, + "latest_activity_at": 1788966908.7169383, "latest_state": "COMPLIANT" }, { @@ -475,7 +478,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/runner", "tags": {}, - "latest_activity_at": 1788164408.5952742, + "latest_activity_at": 1788779420.6871865, "latest_state": "COMPLIANT" }, { @@ -487,7 +490,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/saver", "tags": {}, - "latest_activity_at": 1788252908.7716892, + "latest_activity_at": 1788966908.7169383, "latest_state": "COMPLIANT" }, { @@ -499,7 +502,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/spooler", "tags": {}, - "latest_activity_at": 1787904009.021726, + "latest_activity_at": 1788965708.8099022, "latest_state": "COMPLIANT" }, { @@ -511,7 +514,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n - name: pull-request\n type: pull_request\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/terraform-base-infra", "tags": {}, - "latest_activity_at": 1785232808.6739333, + "latest_activity_at": 1789022420.955772, "latest_state": "COMPLIANT" }, { @@ -523,7 +526,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/web", "tags": {}, - "latest_activity_at": 1787905808.789012, + "latest_activity_at": 1788966908.7169383, "latest_state": "COMPLIANT" }, { @@ -533,9 +536,9 @@ kosli list flows --output=json "visibility": "private", "org": "cyber-dojo", "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", - "repo_url": "https://github.com/cyber-dojo/runner", + "repo_url": "https://github.com/cyber-dojo/creator", "tags": {}, - "latest_activity_at": 1788256412.1366148, + "latest_activity_at": 1789023513.161667, "latest_state": "COMPLIANT" }, { @@ -559,7 +562,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n - name: terraform-apply\n type: generic\n - name: pull-request\n type: pull_request\n artifacts:\n - name: terraform-state\n - name: drift-plan\n", "repo_url": "https://github.com/cyber-dojo/terraform-base-infra", "tags": {}, - "latest_activity_at": 1785236322.8149745, + "latest_activity_at": 1789033111.9033823, "latest_state": "COMPLIANT" }, { @@ -571,7 +574,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n", "repo_url": "", "tags": {}, - "latest_activity_at": 1785166016.9913907, + "latest_activity_at": 1788864204.335966, "latest_state": "COMPLIANT" }, { @@ -583,7 +586,7 @@ kosli list flows --output=json "template": "version: 1\ntrail:\n attestations:\n - name: terraform-plan\n type: generic\n", "repo_url": "", "tags": {}, - "latest_activity_at": 1785232718.7436328, + "latest_activity_at": 1789025050.5326853, "latest_state": "COMPLIANT" }, { @@ -600,7 +603,7 @@ kosli list flows --output=json "kind": "build", "env": "aws-beta" }, - "latest_activity_at": 1788074998.5362537, + "latest_activity_at": 1789022878.756657, "latest_state": "COMPLIANT" } ] diff --git a/client_reference/kosli_list_policies.md b/client_reference/kosli_list_policies.md index 3c54b12b..47e5afed 100644 --- a/client_reference/kosli_list_policies.md +++ b/client_reference/kosli_list_policies.md @@ -22,7 +22,7 @@ List environment policies for an org. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_repos.md b/client_reference/kosli_list_repos.md index 6121252d..4a12b168 100644 --- a/client_reference/kosli_list_repos.md +++ b/client_reference/kosli_list_repos.md @@ -36,7 +36,7 @@ Results are sorted by repo name; use --sort-direction to choose asc or desc. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_service-accounts.md b/client_reference/kosli_list_service-accounts.md index 69b58a52..9824050d 100644 --- a/client_reference/kosli_list_service-accounts.md +++ b/client_reference/kosli_list_service-accounts.md @@ -26,7 +26,7 @@ response for scripting. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_list_snapshots.md b/client_reference/kosli_list_snapshots.md index 4daf90d1..8c0cd4f7 100644 --- a/client_reference/kosli_list_snapshots.md +++ b/client_reference/kosli_list_snapshots.md @@ -38,7 +38,7 @@ Either expression can be omitted to default to NOW. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -64,109 +64,109 @@ kosli list snapshots aws-prod --output=json ```json [ { - "index": 5309, - "from": 1788256325.6192138, + "index": 5352, + "from": 1789108858.5535865, "to": 0.0, "compliant": true, - "duration": 4114.5881407260895 + "duration": 5193.242860555649 }, { - "index": 5308, - "from": 1788256258.609352, - "to": 1788256325.6192138, + "index": 5351, + "from": 1789108798.4511206, + "to": 1789108858.5535865, "compliant": true, - "duration": 67.00986170768738 + "duration": 60.102465867996216 }, { - "index": 5307, - "from": 1788256138.680238, - "to": 1788256258.609352, + "index": 5350, + "from": 1789023418.5988352, + "to": 1789108798.4511206, "compliant": true, - "duration": 119.92911410331726 + "duration": 85379.85228538513 }, { - "index": 5306, - "from": 1788256078.451175, - "to": 1788256138.680238, + "index": 5349, + "from": 1789023358.6002493, + "to": 1789023418.5988352, "compliant": true, - "duration": 60.22906303405762 + "duration": 59.99858593940735 }, { - "index": 5305, - "from": 1788255898.5005004, - "to": 1788256078.451175, + "index": 5348, + "from": 1789022878.756657, + "to": 1789023358.6002493, "compliant": true, - "duration": 179.950674533844 + "duration": 479.8435924053192 }, { - "index": 5304, - "from": 1788255838.4418423, - "to": 1788255898.5005004, + "index": 5347, + "from": 1789022818.5234735, + "to": 1789022878.756657, "compliant": true, - "duration": 60.05865812301636 + "duration": 60.23318338394165 }, { - "index": 5303, - "from": 1788255778.7566388, - "to": 1788255838.4418423, - "compliant": true, - "duration": 59.685203552246094 + "index": 5346, + "from": 1789022458.3400946, + "to": 1789022818.5234735, + "compliant": false, + "duration": 360.18337893486023 }, { - "index": 5302, - "from": 1788255478.4228623, - "to": 1788255778.7566388, + "index": 5345, + "from": 1789022398.786734, + "to": 1789022458.3400946, "compliant": true, - "duration": 300.333776473999 + "duration": 59.55336046218872 }, { - "index": 5301, - "from": 1788255418.2849495, - "to": 1788255478.4228623, + "index": 5344, + "from": 1788964738.4864616, + "to": 1789022398.786734, "compliant": true, - "duration": 60.13791275024414 + "duration": 57660.30027246475 }, { - "index": 5300, - "from": 1788254758.42325, - "to": 1788255418.2849495, + "index": 5343, + "from": 1788957658.4472558, + "to": 1788964738.4864616, "compliant": true, - "duration": 659.8616995811462 + "duration": 7080.039205789566 }, { - "index": 5299, - "from": 1788253018.4181795, - "to": 1788254758.42325, + "index": 5342, + "from": 1788945958.5053656, + "to": 1788957658.4472558, "compliant": true, - "duration": 1740.0050704479218 + "duration": 11699.941890239716 }, { - "index": 5298, - "from": 1788251398.4699006, - "to": 1788253018.4181795, + "index": 5341, + "from": 1788945898.464788, + "to": 1788945958.5053656, "compliant": true, - "duration": 1619.9482789039612 + "duration": 60.04057765007019 }, { - "index": 5297, - "from": 1788245458.5681827, - "to": 1788251398.4699006, + "index": 5340, + "from": 1788936118.496684, + "to": 1788945898.464788, "compliant": true, - "duration": 5939.90171790123 + "duration": 9779.96810388565 }, { - "index": 5296, - "from": 1788245398.8278637, - "to": 1788245458.5681827, + "index": 5339, + "from": 1788935998.397991, + "to": 1788936118.496684, "compliant": true, - "duration": 59.74031901359558 + "duration": 120.09869313240051 }, { - "index": 5295, - "from": 1788245338.6744468, - "to": 1788245398.8278637, + "index": 5338, + "from": 1788867598.4601083, + "to": 1788935998.397991, "compliant": true, - "duration": 60.153416872024536 + "duration": 68399.93788266182 } ] ``` diff --git a/client_reference/kosli_list_trails.md b/client_reference/kosli_list_trails.md index 8d6b6f12..50240c8a 100644 --- a/client_reference/kosli_list_trails.md +++ b/client_reference/kosli_list_trails.md @@ -27,7 +27,7 @@ List Trails of an org.The list can be filtered by flow, flow tag and artifact fi | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_log_environment.md b/client_reference/kosli_log_environment.md index 4e43c378..93c6b4c1 100644 --- a/client_reference/kosli_log_environment.md +++ b/client_reference/kosli_log_environment.md @@ -45,7 +45,7 @@ You can also filter events by range using --start/--end (snapshot index or time | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | @@ -72,24 +72,24 @@ kosli log environment aws-prod --output=json [ { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:84e986a@sha256:06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "sha256": "06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", + "snapshot_index": 5352, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:99d7b74@sha256:a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "sha256": "a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "saver-ci", + "reported_at": 1789108858.5535865, + "pipeline": "creator-ci", "deployments": [], "flows": [ { - "flow_name": "saver-ci", + "flow_name": "creator-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -100,38 +100,38 @@ kosli log environment aws-prod --output=json "artifact_compliance": true, "snapshot_compliance": true, "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/saver/compare/36f0420f728fe61e44a3ab0043cf9a3d70863cad...84e986ad70d32e9be362d5bd9ce7c7af94f6eaab", + "code_diff": "https://github.com/cyber-dojo/creator/compare/abdc61396b5031dbb1e90f5c9c190d303ff243e1...99d7b74f39e311d492902ad48dbe97da63f2c687", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/saver-ci/fingerprint/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f", - "html": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/06f85cc53010535e46f13c348a1aaf5c8dfee0c0fea7f81105312b6c87d5d05f?artifact_id=a599cb04-5965-46a6-a774-24dc6341" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=205424b6-5741-4071-bd36-c26e83f6" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5352", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5352" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:27b3504@sha256:1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "sha256": "1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:5d1d4b6@sha256:040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "sha256": "040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "nginx-ci", + "reported_at": 1789108798.4511206, + "pipeline": "languages-start-points-ci", "deployments": [], "flows": [ { - "flow_name": "nginx-ci", + "flow_name": "languages-start-points-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -141,26 +141,26 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/nginx/compare/fb791742054fa28dd89269aac8002ebfd7b3386e...27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/languages-start-points/compare/8e6b51867675d4b652a38353611cde1d8567fce0...5d1d4b6035691d7986e05ab263e521b3e711fa0c", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/nginx-ci/fingerprint/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21", - "html": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/1d1a2f8e2ea649bac20578eea7b18c9f03cda4cad5118cefbf425521a77ead21?artifact_id=9045bb07-ea42-482f-99c3-4fe5b86f" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/languages-start-points-ci/fingerprint/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909", + "html": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/040bd44819d9e92728fb3b338f6582d4345cd69df769c59e94c61ac0336ad909?artifact_id=f5813ac8-1ad7-433a-beee-f90a065d" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:ff9f292@sha256:2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "sha256": "2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:6b20a42@sha256:4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "sha256": "4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", "description": "1 instance changed", - "reported_at": 1788256325.6192138, + "reported_at": 1789108798.4511206, "pipeline": "dashboard-ci", "deployments": [], "flows": [ @@ -169,11 +169,11 @@ kosli log environment aws-prod --output=json "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -183,39 +183,39 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/dashboard/compare/2b300f450f72006f6a9000aaf9cd04485f1e8095...ff9f292e809801d35246183988b7812826bc2760", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/dashboard/compare/ff9f292e809801d35246183988b7812826bc2760...6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/dashboard-ci/fingerprint/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f", - "html": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/2827829889b4acc994c3ffbfca250346d5f1f0ddf21847bcbe4864ae484ebe4f?artifact_id=aa6c0c1d-2d5d-4c98-9f9d-1160dd2f" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/dashboard-ci/fingerprint/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "html": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=7ba704a0-8706-4f12-9eb8-776c7e5d" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/languages-start-points:a357ebd@sha256:28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "sha256": "28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "languages-start-points-ci", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:4b2bfc0@sha256:8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "sha256": "8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "description": "3 instances changed", + "reported_at": 1789108798.4511206, + "pipeline": "runner-ci", "deployments": [], "flows": [ { - "flow_name": "languages-start-points-ci", + "flow_name": "runner-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -225,39 +225,39 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/languages-start-points/compare/068b3424c7da843a4f2d428d2e4915f33efc4a02...a357ebd85acdd54968fa0192405aaf2e289d27c9", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/runner/compare/ca65b67c3e311fbdd2435609fdb6f8a5479f66f9...4b2bfc038576e2a7648090c4c1289fbc9ebfc481", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/languages-start-points-ci/fingerprint/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832", - "html": "https://app.kosli.com/cyber-dojo/flows/languages-start-points-ci/artifacts/28bc41a2185a154249b1d06983741c39beb3574ebdce7273963ecde2ae9dd832?artifact_id=8e028a8d-a1f2-4732-8663-47012b29" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/runner-ci/fingerprint/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f", + "html": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/8e36719b74e24f93433b2fa52107beec253f7f5dc2fcefc4aad60befe31db65f?artifact_id=612b9903-ce02-40a7-a329-77b10931" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:b12a5c9@sha256:34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "sha256": "34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/saver:7c4708f@sha256:9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "sha256": "9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "custom-start-points-ci", + "reported_at": 1789108798.4511206, + "pipeline": "saver-ci", "deployments": [], "flows": [ { - "flow_name": "custom-start-points-ci", + "flow_name": "saver-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -267,31 +267,31 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/custom-start-points/compare/790d86b66f4d86ab47f5c521daf5039dc8aeef4d...b12a5c9b17023462d13e81381a69c7ef05f84dc2", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/saver/compare/9030f8f46e738d94bd817727b8f8a9a54f106585...7c4708f675a7717376529273ec32d08cd93f5c26", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/custom-start-points-ci/fingerprint/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09", - "html": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/34fd30b5a876821ef7047c3e3af23158705ec2ea1f63fa784854639ccd807b09?artifact_id=2aa23627-9e91-488e-b3ea-e4bf2e22" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/saver-ci/fingerprint/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc", + "html": "https://app.kosli.com/cyber-dojo/flows/saver-ci/artifacts/9cfef3281fc531a3c5a5a00ed8a67256e1b954b5271b03936808623960afebfc?artifact_id=326e1373-e805-48be-bfc7-6631db28" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:cbe481c@sha256:36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "sha256": "36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "description": "3 instances changed", - "reported_at": 1788256325.6192138, - "pipeline": "web-ci", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:5e4740c@sha256:9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "sha256": "9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "description": "1 instance changed", + "reported_at": 1789108798.4511206, + "pipeline": "spooler-ci", "deployments": [], "flows": [ { - "flow_name": "web-ci", + "flow_name": "spooler-ci", "deployments": null }, { @@ -309,35 +309,31 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/web/compare/5e4b9873df93525c041c386c06e0ab8fc36b6f33...cbe481c4b842f897e4e9e411cd78461a3a12a334", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/spooler/compare/90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f...5e4740c1146988f2e90cd2eb2fc6de0f8603e20a", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/web-ci/fingerprint/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc", - "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/36ad0020c6cd8716c1463808a185ca65379ec8151a9619d72549ee597d86accc?artifact_id=41957e62-eaad-48d2-af40-46879efb" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/spooler-ci/fingerprint/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f", + "html": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/9ef10b455706661560fee5c47aebcb592f0936fdaa1db1a0ad06590c6f39b86f?artifact_id=df1b0b8e-7efa-415e-860d-9123aa27" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:f22a30e@sha256:41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "sha256": "41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:99d7b74@sha256:a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "sha256": "a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "exercises-start-points-ci", + "reported_at": 1789108798.4511206, + "pipeline": "creator-ci", "deployments": [], "flows": [ { - "flow_name": "exercises-start-points-ci", - "deployments": null - }, - { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "creator-ci", "deployments": null }, { @@ -345,45 +341,45 @@ kosli log environment aws-prod --output=json "deployments": null }, { - "flow_name": "snyk-aws-prod-per-artifact", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null } ], "artifact_compliance": true, "snapshot_compliance": true, "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/exercises-start-points/compare/258b6d07d2b28ad5cb2ce6d29934997f72380f1a...f22a30ed7659b05a88c22e9f22dc2388f2deb8c8", + "code_diff": "https://github.com/cyber-dojo/creator/compare/abdc61396b5031dbb1e90f5c9c190d303ff243e1...99d7b74f39e311d492902ad48dbe97da63f2c687", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/exercises-start-points-ci/fingerprint/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6", - "html": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/41aab2a45d074e91162ffde031d094118f0be3bdffa4d769ea24b415f5e8a9d6?artifact_id=aa4300d4-b690-4d71-9596-6af987e1" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=205424b6-5741-4071-bd36-c26e83f6" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/spooler:90c8d98@sha256:6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "sha256": "6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/nginx:bd3938c@sha256:aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "sha256": "aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "spooler-ci", + "reported_at": 1789108798.4511206, + "pipeline": "nginx-ci", "deployments": [], "flows": [ { - "flow_name": "spooler-ci", + "flow_name": "nginx-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -393,39 +389,39 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/spooler/compare/dc7dea2d9086fcdfe4629f3ab02501ed92aad1bb...90c8d982d2ff8c4950f7aca4d0a1e9d29ac74e1f", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/nginx/compare/27b350410ebcca5ff192f2ca4cdd0e3e49f5ac65...bd3938c88623bff4f02e1c2f12e97f7cd60523e3", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/spooler-ci/fingerprint/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd", - "html": "https://app.kosli.com/cyber-dojo/flows/spooler-ci/artifacts/6440151a9419255a47d8f9fb0e610f5af3f555ad68fa84a50f950abae8b098fd?artifact_id=6df79438-91a2-4c2b-a945-52fb5218" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/nginx-ci/fingerprint/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5", + "html": "https://app.kosli.com/cyber-dojo/flows/nginx-ci/artifacts/aa63057d266fea8e2336b5d046a85889dd2ec37023cb81a465f6fff6c999c2c5?artifact_id=30338133-ceb7-4976-8956-e0b140cf" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5309, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "sha256": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/exercises-start-points:d01bb39@sha256:bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "sha256": "bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", "description": "1 instance changed", - "reported_at": 1788256325.6192138, - "pipeline": "creator-ci", + "reported_at": 1789108798.4511206, + "pipeline": "exercises-start-points-ci", "deployments": [], "flows": [ { - "flow_name": "creator-ci", + "flow_name": "exercises-start-points-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -435,39 +431,39 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/exercises-start-points/compare/f22a30ed7659b05a88c22e9f22dc2388f2deb8c8...d01bb39495a1356eabe934bef84b92cc964a26f1", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/exercises-start-points-ci/fingerprint/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31", + "html": "https://app.kosli.com/cyber-dojo/flows/exercises-start-points-ci/artifacts/bc1dae4e8ce742e027a6dc6b68e44c65361cd48e588483d3fd9f6d6911a84c31?artifact_id=6884abdb-afdd-4c56-aa14-94e8da5c" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5309", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5309" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5308, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:bcac1c1@sha256:03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "sha256": "03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "description": "1 instance changed", - "reported_at": 1788256258.609352, - "pipeline": "differ-ci", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/web:236898f@sha256:e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "sha256": "e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "description": "3 instances changed", + "reported_at": 1789108798.4511206, + "pipeline": "web-ci", "deployments": [], "flows": [ { - "flow_name": "differ-ci", + "flow_name": "web-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -477,39 +473,39 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/differ/compare/108cccf9bccf9af5d455db66c250480b53cbecc7...bcac1c18385b2573ef6c6e8eeae0f62ed14a03de", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/web/compare/cbe481c4b842f897e4e9e411cd78461a3a12a334...236898f12a3bcce3b60625dd71c6f817d4cc37c2", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/differ-ci/fingerprint/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab", - "html": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/03e520a0dcb9da3889b23ef3ab7f0fa29e4c4a7a9d42c2ce022b78a053157bab?artifact_id=11345222-f37a-4f8d-8051-ec26a321" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/web-ci/fingerprint/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418", + "html": "https://app.kosli.com/cyber-dojo/flows/web-ci/artifacts/e24bd03714d2e583a2196c0eaf82b2aad8eeecf73f29aec58875994b82f0f418?artifact_id=9d418e45-a78d-462a-b8be-aaf2fc85" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5308", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5308" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5308, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:ca65b67@sha256:a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "sha256": "a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "description": "3 instances changed", - "reported_at": 1788256258.609352, - "pipeline": "runner-ci", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/custom-start-points:86c839e@sha256:ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "sha256": "ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "description": "1 instance changed", + "reported_at": 1789108798.4511206, + "pipeline": "custom-start-points-ci", "deployments": [], "flows": [ { - "flow_name": "runner-ci", + "flow_name": "custom-start-points-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -519,39 +515,39 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "updated-provenance", - "code_diff": "https://github.com/cyber-dojo/runner/compare/976b63e8001ec7441ebc7737ca69f620d47e7ffe...ca65b67c3e311fbdd2435609fdb6f8a5479f66f9", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/custom-start-points/compare/b12a5c9b17023462d13e81381a69c7ef05f84dc2...86c839ee588f393d84a6b9c036478d10bb6f2a2d", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/runner-ci/fingerprint/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638", - "html": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/a1b8379841b440286b5649db7517419457b8fdb01398a661bae9ae0c92b05638?artifact_id=3b03ceaf-96a6-4afa-8aa2-179e5fe9" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/custom-start-points-ci/fingerprint/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e", + "html": "https://app.kosli.com/cyber-dojo/flows/custom-start-points-ci/artifacts/ed0b8b8cc04f951bc7224d792c9c68010388f9ebf3c45d9a5d375be3a68d0b2e?artifact_id=60d0583d-4388-4a0a-925d-5b47d9a8" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5308", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5308" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5307, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:83357f1@sha256:adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "sha256": "adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "description": "1 instance stopped running (from 1 to 0)", - "reported_at": 1788256138.680238, - "pipeline": "creator-ci", + "snapshot_index": 5351, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:2e9bd96@sha256:f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "sha256": "f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "description": "1 instance changed", + "reported_at": 1789108798.4511206, + "pipeline": "differ-ci", "deployments": [], "flows": [ { - "flow_name": "creator-ci", + "flow_name": "differ-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -561,26 +557,26 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "exited", - "code_diff": "https://github.com/cyber-dojo/creator/compare/89019f6d8059406e56fa499b2dec2dbf93f4d5c7...83357f112ef5c10b157cb84732c77965cc8ddc48", + "type": "changed", + "code_diff": "https://github.com/cyber-dojo/differ/compare/bcac1c18385b2573ef6c6e8eeae0f62ed14a03de...2e9bd969b50fff6b86578d69b7139f2d688ef6e2", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b", - "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/adb922d738b50876f1cd13f5a998ade341abfd64b3561d0889264399c33c528b?artifact_id=11539f6a-befb-4b79-9484-fd9f25d3" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/differ-ci/fingerprint/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409", + "html": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/f61d363b12c540302c97e4f694c76edc6fcb594852e2dcdb8ce92d2d22521409?artifact_id=054eef05-3aee-49ae-9e4d-55f768b7" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5307", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5307" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5351", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5351" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5306, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:d64d2b1@sha256:c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "sha256": "c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "description": "1 instance started running (from 0 to 1)", - "reported_at": 1788256078.451175, + "snapshot_index": 5350, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:abdc613@sha256:ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "sha256": "ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "description": "1 instance stopped running (from 1 to 0)", + "reported_at": 1789023418.5988352, "pipeline": "creator-ci", "deployments": [], "flows": [ @@ -588,46 +584,46 @@ kosli log environment aws-prod --output=json "flow_name": "creator-ci", "deployments": null }, + { + "flow_name": "production-promotion", + "deployments": null + }, { "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-prod-per-artifact", "deployments": null } ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "started-compliant", - "code_diff": "https://github.com/cyber-dojo/creator/compare/83357f112ef5c10b157cb84732c77965cc8ddc48...d64d2b11879179255f11dc991e81fbaf4a040264", + "type": "exited", + "code_diff": "https://github.com/cyber-dojo/creator/compare/3992c3ac326ff4472870fb49736a31967df95555...abdc61396b5031dbb1e90f5c9c190d303ff243e1", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab", - "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/c48710e3304e24406c03381a31d01f520ab2f60846aa0b57adbda0a776ebc1ab?artifact_id=61384b36-4d32-43f2-8d5d-a72e2e7e" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a", + "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/ba988cfdac64da22bc8268442c467504fe8df565e65c2f3c4344ce00c83e561a?artifact_id=77dd7d10-64d9-4d28-a29a-bc7aaba0" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5306", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5306" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5350", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5350" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5305, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/runner:976b63e@sha256:01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "sha256": "01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "description": "1 instance stopped running (from 1 to 0)", - "reported_at": 1788255898.5005004, - "pipeline": "runner-ci", + "snapshot_index": 5349, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/creator:99d7b74@sha256:a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "sha256": "a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "description": "1 instance started running (from 0 to 1)", + "reported_at": 1789023358.6002493, + "pipeline": "creator-ci", "deployments": [], "flows": [ { - "flow_name": "runner-ci", - "deployments": null - }, - { - "flow_name": "production-promotion", + "flow_name": "creator-ci", "deployments": null }, { @@ -635,45 +631,45 @@ kosli log environment aws-prod --output=json "deployments": null }, { - "flow_name": "snyk-aws-prod-per-artifact", + "flow_name": "production-promotion", "deployments": null } ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "exited", - "code_diff": "https://github.com/cyber-dojo/runner/compare/d7541d3fb2c548bd68a81f812b5a6c95fcf9a1bd...976b63e8001ec7441ebc7737ca69f620d47e7ffe", + "type": "started-compliant", + "code_diff": "https://github.com/cyber-dojo/creator/compare/abdc61396b5031dbb1e90f5c9c190d303ff243e1...99d7b74f39e311d492902ad48dbe97da63f2c687", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/runner-ci/fingerprint/01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9", - "html": "https://app.kosli.com/cyber-dojo/flows/runner-ci/artifacts/01311f8b73bb61f65baabe680aa75ef9c0e6c5d1697ad81cfd89c89812de6fe9?artifact_id=e63d6d6b-d7ee-4fad-a66a-32a4ebba" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/creator-ci/fingerprint/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424", + "html": "https://app.kosli.com/cyber-dojo/flows/creator-ci/artifacts/a39fa3230549d3c6cb1732cc929c4e21041a09a21b2bb692cd37c9afe5fcd424?artifact_id=205424b6-5741-4071-bd36-c26e83f6" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5305", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5305" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5349", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5349" } } }, { "environment_name": "aws-prod", - "snapshot_index": 5304, - "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/differ:108cccf@sha256:31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "sha256": "31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "description": "1 instance stopped running (from 1 to 0)", - "reported_at": 1788255838.4418423, - "pipeline": "differ-ci", + "snapshot_index": 5348, + "artifact_name": "244531986313.dkr.ecr.eu-central-1.amazonaws.com/dashboard:6b20a42@sha256:4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "sha256": "4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "description": "1 instance started running (from 0 to 1)", + "reported_at": 1789022878.756657, + "pipeline": "dashboard-ci", "deployments": [], "flows": [ { - "flow_name": "differ-ci", + "flow_name": "dashboard-ci", "deployments": null }, { - "flow_name": "snyk-aws-beta-per-artifact", + "flow_name": "production-promotion", "deployments": null }, { - "flow_name": "production-promotion", + "flow_name": "snyk-aws-beta-per-artifact", "deployments": null }, { @@ -683,16 +679,16 @@ kosli log environment aws-prod --output=json ], "artifact_compliance": true, "snapshot_compliance": true, - "type": "exited", - "code_diff": "https://github.com/cyber-dojo/differ/compare/10e162d4e1294815375a31121f14d57e13183b34...108cccf9bccf9af5d455db66c250480b53cbecc7", + "type": "started-compliant", + "code_diff": "https://github.com/cyber-dojo/dashboard/compare/ff9f292e809801d35246183988b7812826bc2760...6b20a423d5ce05139d4480e9ce67f40e3eda2e07", "_links": { "artifact": { - "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/differ-ci/fingerprint/31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac", - "html": "https://app.kosli.com/cyber-dojo/flows/differ-ci/artifacts/31a4c3abc3ccef33397ed1d84496a08d94ca9d6f9d0df44b6a72aba9743bc8ac?artifact_id=50b8cff6-1888-4c76-b31a-fdd7a311" + "self": "https://app.kosli.com/api/v2/artifacts/cyber-dojo/dashboard-ci/fingerprint/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29", + "html": "https://app.kosli.com/cyber-dojo/flows/dashboard-ci/artifacts/4889ce921333abe3acc52880342a6ceb27cd66482e4f8fc93e20d5a91d972d29?artifact_id=7ba704a0-8706-4f12-9eb8-776c7e5d" }, "snapshot": { - "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5304", - "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5304" + "self": "https://app.kosli.com/api/v2/snapshots/cyber-dojo/aws-prod/5348", + "html": "https://app.kosli.com/cyber-dojo/environments/aws-prod/snapshots/5348" } } } diff --git a/client_reference/kosli_rename_environment.md b/client_reference/kosli_rename_environment.md index d32f5813..81a2eacf 100644 --- a/client_reference/kosli_rename_environment.md +++ b/client_reference/kosli_rename_environment.md @@ -24,7 +24,7 @@ The environment will remain accessible under its old name until that name is tak | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_rename_flow.md b/client_reference/kosli_rename_flow.md index 8fc6842c..074a2033 100644 --- a/client_reference/kosli_rename_flow.md +++ b/client_reference/kosli_rename_flow.md @@ -24,7 +24,7 @@ The flow will remain accessible under its old name until that name is taken by a | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_report_artifact.md b/client_reference/kosli_report_artifact.md index ee1b4107..92a51214 100644 --- a/client_reference/kosli_report_artifact.md +++ b/client_reference/kosli_report_artifact.md @@ -45,7 +45,10 @@ is set), registry credentials are resolved as follows: To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -70,7 +73,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_rotate_api-key.md b/client_reference/kosli_rotate_api-key.md index 762fe2a8..b31f147e 100644 --- a/client_reference/kosli_rotate_api-key.md +++ b/client_reference/kosli_rotate_api-key.md @@ -31,7 +31,7 @@ make sure to store it securely. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_search.md b/client_reference/kosli_search.md index 34d59a91..9ff6eeed 100644 --- a/client_reference/kosli_search.md +++ b/client_reference/kosli_search.md @@ -23,7 +23,7 @@ You can use short git commit or artifact fingerprint shas, but you must provide | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_snapshot_azure.md b/client_reference/kosli_snapshot_azure.md index 5a02f485..fa2320f7 100644 --- a/client_reference/kosli_snapshot_azure.md +++ b/client_reference/kosli_snapshot_azure.md @@ -20,9 +20,17 @@ will not match. See https://learn.microsoft.com/en-us/azure/azure-functions/functions-app-settings#website_run_from_package For zip-deployed apps, the fingerprint respects a `.kosli_ignore` file at the root of the deployed package. + +With `--digests-source acr`, the registry is taken from each app's own container configuration. Azure +credentials are only ever sent to an Azure Container Registry login server. An app whose image comes +from any other registry is read without credentials, which works for a public image but not a private +one; report those apps with `--digests-source logs` instead. + +`--dry-run` suppresses only the request to Kosli. Azure discovery and registry lookups still run. To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. To authenticate to Azure, you need to create Azure service principal with a secret and provide these Azure credentials via flags or by exporting the equivalent KOSLI env vars (e.g. KOSLI_AZURE_CLIENT_ID). @@ -40,7 +48,7 @@ The service principal needs to have the following permissions: | `--azure-resource-group-name` | string | Azure resource group name. | | `--azure-subscription-id` | string | Azure subscription ID. | | `--azure-tenant-id` | string | Azure tenant ID. | -| `--digests-source` | string | [defaulted] Where to get the digests from. Valid values are 'acr' and 'logs'. (default "acr") | +| `--digests-source` | string | [defaulted] Where to get the digests from. Valid values are 'acr' and 'logs'. With 'acr', Azure credentials are only sent to Azure Container Registry login servers; an app whose image comes from any other registry is read without credentials, so a private third-party registry needs 'logs'. (default "acr") | | `-D`, `--dry-run` | bool | [optional] Run in dry-run mode. When enabled, no data is sent to Kosli and the CLI exits with 0 exit code regardless of any errors. | | `-h`, `--help` | bool | help for azure | | `--zip` | bool | Download logs from Azure as zip files | @@ -51,7 +59,7 @@ The service principal needs to have the following permissions: | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_cloud-run.md b/client_reference/kosli_snapshot_cloud-run.md index 67b2657f..eac2df4c 100644 --- a/client_reference/kosli_snapshot_cloud-run.md +++ b/client_reference/kosli_snapshot_cloud-run.md @@ -71,7 +71,7 @@ reverse-lookup. Only supported for Artifact Registry hosts. | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_docker.md b/client_reference/kosli_snapshot_docker.md index 52929c47..0fa76b6c 100644 --- a/client_reference/kosli_snapshot_docker.md +++ b/client_reference/kosli_snapshot_docker.md @@ -26,7 +26,7 @@ been pushed to or pulled from a registry will be ignored. | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_ecs.md b/client_reference/kosli_snapshot_ecs.md index 928b54b3..dc5c6e65 100644 --- a/client_reference/kosli_snapshot_ecs.md +++ b/client_reference/kosli_snapshot_ecs.md @@ -54,7 +54,7 @@ More details can be found here: https://aws.github.io/aws-sdk-go-v2/docs/configu | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_lambda.md b/client_reference/kosli_snapshot_lambda.md index 9ed59af1..fcd9b45c 100644 --- a/client_reference/kosli_snapshot_lambda.md +++ b/client_reference/kosli_snapshot_lambda.md @@ -42,7 +42,7 @@ More details can be found here: https://aws.github.io/aws-sdk-go-v2/docs/configu | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_path.md b/client_reference/kosli_snapshot_path.md index c3df2c4a..abeaa16f 100644 --- a/client_reference/kosli_snapshot_path.md +++ b/client_reference/kosli_snapshot_path.md @@ -17,7 +17,10 @@ plus the ability to use recursive globs "**" To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -35,7 +38,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_paths.md b/client_reference/kosli_snapshot_paths.md index 894615c9..84ee7c6c 100644 --- a/client_reference/kosli_snapshot_paths.md +++ b/client_reference/kosli_snapshot_paths.md @@ -23,7 +23,10 @@ plus the ability to use recursive globs "**" To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. This is an example YAML paths spec file: ```yaml @@ -48,7 +51,7 @@ artifacts: | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_s3.md b/client_reference/kosli_snapshot_s3.md index 1c10ea5c..a70cf8fb 100644 --- a/client_reference/kosli_snapshot_s3.md +++ b/client_reference/kosli_snapshot_s3.md @@ -21,10 +21,12 @@ More details can be found here: https://aws.github.io/aws-sdk-go-v2/docs/configu You can report the entire bucket content, or filter some of the content using `--include` / `--exclude` (literal prefix match) or `--include-regex` / `--exclude-regex` (Go regular expressions matched against the full object key). In all cases, the content is reported as one artifact. If you wish to report separate files/dirs within the same bucket as separate artifacts, you need to run the command twice. +Object keys that cannot be stored as a local file, such as keys containing a `..` path segment, are rejected and fail the snapshot, naming the key. Two keys that resolve to the same local file are also an error. A legitimate key of that shape can be left out with `--exclude-regex` (anchor and escape it, since the pattern is a regular expression matched against the whole key); when `--include` or `--include-regex` is set, exclude filters are ignored, so narrow the include filter instead. To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. ## Flags | Flag | Type | Description | @@ -46,7 +48,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_snapshot_server.md b/client_reference/kosli_snapshot_server.md index 91d43c14..b86d4461 100644 --- a/client_reference/kosli_snapshot_server.md +++ b/client_reference/kosli_snapshot_server.md @@ -43,7 +43,10 @@ If the directory structure contains a symbolic link to a *directory* (for exampl To specify paths in a directory artifact that should always be excluded from the SHA256 calculation, you can add a `.kosli_ignore` file to the root of the artifact. Each line should specify a relative path or path glob to be ignored. You can include comments in this file, using `#`. -The `.kosli_ignore` will be treated as part of the artifact like any other file, unless it is explicitly ignored itself. +The `.kosli_ignore` file is always treated as part of the artifact: its own entries cannot exclude it, so the exclusion list cannot be changed without changing the fingerprint. +Paths the list already matches stay excluded whatever is later added there, so keep its entries as narrow as possible. +Excluding the file with `--exclude` keeps it out of the fingerprint but still applies the paths it lists, which lets a writable directory change the list again. +To drop the file from the fingerprint safely, move its entries to `--exclude` and delete it. ## Flags | Flag | Type | Description | @@ -60,7 +63,7 @@ The `.kosli_ignore` will be treated as part of the artifact like any other file, | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | | `-A`, `--auto-environment` | bool | [optional] Create the environment (with the type inferred from the snapshot subcommand) if it does not already exist, before reporting the snapshot. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `--environment-description` | string | [optional] The environment description. | | `--exclude-scaling` | bool | [optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records. (DEPRECATED: this flag is deprecated and will be removed in a future version. Scaling events do not trigger new snapshots.) | diff --git a/client_reference/kosli_status.md b/client_reference/kosli_status.md index 72331a3e..9eab4cb8 100644 --- a/client_reference/kosli_status.md +++ b/client_reference/kosli_status.md @@ -24,7 +24,7 @@ If you like to assert the Kosli server status, you can use the `--assert` flag o | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_tag.md b/client_reference/kosli_tag.md index 18227a97..0c55d1e9 100644 --- a/client_reference/kosli_tag.md +++ b/client_reference/kosli_tag.md @@ -37,7 +37,7 @@ name as-is, whereas a real run sends the resolved ID. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_unarchive_control.md b/client_reference/kosli_unarchive_control.md index 08a25f0f..9e7d4a86 100644 --- a/client_reference/kosli_unarchive_control.md +++ b/client_reference/kosli_unarchive_control.md @@ -29,7 +29,7 @@ Restores a previously archived control to the active state. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_update_control.md b/client_reference/kosli_update_control.md index 127caa99..e1903e51 100644 --- a/client_reference/kosli_update_control.md +++ b/client_reference/kosli_update_control.md @@ -33,7 +33,7 @@ Providing `--link` replaces all of the control's existing links. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_update_default-org.md b/client_reference/kosli_update_default-org.md index 0f9bd595..f9953074 100644 --- a/client_reference/kosli_update_default-org.md +++ b/client_reference/kosli_update_default-org.md @@ -24,7 +24,7 @@ The default organization is the one selected by default in the Kosli Web UI when | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_update_service-account.md b/client_reference/kosli_update_service-account.md index 2687390f..bf0aec6c 100644 --- a/client_reference/kosli_update_service-account.md +++ b/client_reference/kosli_update_service-account.md @@ -26,7 +26,7 @@ Only the flags you provide are changed; omitted fields are left untouched. | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/kosli_version.md b/client_reference/kosli_version.md index 4e9205f7..fae43a1d 100644 --- a/client_reference/kosli_version.md +++ b/client_reference/kosli_version.md @@ -31,7 +31,7 @@ version.BuildInfo\{Version:"v0.0.1", GitCommit:"fe51cd1e31e6a202cba7dead9552a6d4 | Flag | Type | Description | | :--- | :--- | :--- | | `-a`, `--api-token` | string | The Kosli API token. | -| `-c`, `--config-file` | string | [optional] The Kosli config file path. (default "kosli") | +| `-c`, `--config-file` | string | [optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "$HOME/.kosli.yml") | | `--debug` | bool | [optional] Print debug logs to stdout. | | `-H`, `--host` | string | [defaulted] The Kosli endpoint. (default "https://app.kosli.com") | | `--http-proxy` | string | [optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` | diff --git a/client_reference/overview.md b/client_reference/overview.md index f7b10625..f31ed2d7 100644 --- a/client_reference/overview.md +++ b/client_reference/overview.md @@ -4,7 +4,7 @@ description: "Reference documentation for the Kosli CLI." --- - This reference was generated from Kosli CLI **v2.39.2**. + This reference was generated from Kosli CLI **v2.40.0**. The Kosli CLI allows you to interact with Kosli from your terminal and CI/CD pipelines.