From dc416a55fdb48ac9b8cb5363eeafb779f463d1da Mon Sep 17 00:00:00 2001 From: deven Date: Mon, 12 Oct 2026 00:43:18 +0530 Subject: [PATCH 1/2] CI: fail on test failures and skip image push on pull requests Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci-cd.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 659bee9..c10ab79 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -26,7 +26,7 @@ jobs: run: npm ci - name: Run tests - run: npm test || echo "No tests found, would add tests in a real project" + run: npm test lint: name: Static Code Analysis @@ -96,6 +96,7 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Login to GitHub Container Registry + if: github.event_name == 'push' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -132,6 +133,7 @@ jobs: severity: 'CRITICAL,HIGH' - name: Push Docker image + if: github.event_name == 'push' uses: docker/build-push-action@v5 with: context: . From 02b7b049781f84754b360195e7112a0f13d232fa Mon Sep 17 00:00:00 2001 From: deven Date: Mon, 12 Oct 2026 00:48:18 +0530 Subject: [PATCH 2/2] Upgrade Alpine packages in the nginx stage to clear HIGH CVEs Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index 64bea95..e4cdca1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,6 +8,8 @@ RUN npm run build # Production stage FROM nginx:alpine +# Pull in security fixes newer than the base image (Trivy fails the build on HIGH/CRITICAL) +RUN apk upgrade --no-cache COPY --from=build /app/dist /usr/share/nginx/html # Add nginx configuration if needed # COPY nginx.conf /etc/nginx/conf.d/default.conf