6 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Opus 4.8	3cedb488ac	feat(pipeline): firmware SBOM via tramiton reproducible build (phase 2) ... Upgrade the firmware SBOM from analysis-only to a full reproducible build: run tramiton's NixBackend (`seal_and_build`) over the ingested source to produce a sealed lock whose libraries are pinned and whose firmware artifact carries a content hash, then render the SBOM from the lock plus deep binary SCA of any pre-compiled inputs — the complete bill of materials (toolchain + every fetched library + the firmware image), mapped into `SbomEntry` rows. Graceful by design: when no nix backend is available (or the build fails / times out at 15m), it falls back to the analysis-only components (toolchain + resolvable libraries), so a nix that can't run in the deployment never breaks a scan. Infra: the agent image now installs `nix-portable` (rootless, single binary; best-effort — a failed download just leaves the analysis-only path). The nix store lives under `NP_LOCATION=/data/compliance-scanner` — mount a PERSISTENT volume there in the deployment, otherwise every firmware scan re-fetches nixpkgs + cross toolchains. Adds the `tramiton-sbom` dependency. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-13 12:07:23 +02:00
Sharang Parnerkar	5cafd13f44	ci: log orca webhook response so deploy steps arent silent	2026-04-08 15:09:27 +02:00
Sharang ParnerkarandClaude Opus 4.6	69209649a5	ci: trigger first orca build for all services ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:10:07 +02:00
Sharang ParnerkarandClaude Opus 4.6	d5439adc0d	ci: trigger build of dashboard, docs, mcp images for orca ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:09:49 +02:00
Sharang ParnerkarandClaude Opus 4.6	bc7cdd35e4	ci: replace coolify webhook with orca deploy ... Each deploy job now builds the per-service image, pushes to the private registry as :latest and :sha, then triggers an HMAC-signed orca redeploy webhook. Coolify webhooks are no longer used. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 10:06:11 +02:00
Sharang ParnerkarandClaude Opus 4.6	c062d834a1	fix: downgrade dotenv missing file from FAILED to info message ... Non-fatal in Docker where env vars come from container config. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-30 15:33:24 +02:00