feat: implement high-priority infrastructure improvements#98
Merged
Conversation
1. Centralize Docker image versions in .env - Add Docker image version variables to .env.example - Update docker-compose.yml to use environment variables with defaults - Update Dockerfiles (pgbouncer, forgejo, vector) to use build args - Enables easy version management and consistent upgrades 2. Add actual vulnerability scanning to security workflow - Install and run Trivy on all Docker images - Parse environment variable defaults from docker-compose.yml - Report CRITICAL vulnerabilities with counts - Provide actionable scan summaries 3. Add unit test execution to test workflow - New 'unit-tests' job running Python, Go, and Rust tests - Tests run with continue-on-error (some require services) - Clear messaging about which tests require infrastructure - Updated test-summary to include unit test results
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements the three high-priority improvements identified during the project analysis.
1. Centralized Docker Image Versions
Problem: Docker image versions were hardcoded throughout docker-compose.yml, making upgrades difficult and error-prone.
Solution:
.env.examplewith all image versionsdocker-compose.ymlto use environment variables with sensible defaultsImages centralized:
VAULT_VERSIONPOSTGRES_VERSIONMYSQL_VERSIONMONGODB_VERSIONREDIS_VERSIONRABBITMQ_VERSIONPROMETHEUS_VERSIONGRAFANA_VERSIONLOKI_VERSIONVECTOR_VERSIONCADVISOR_VERSIONPGBOUNCER_VERSIONFORGEJO_VERSIONREDIS_EXPORTER_VERSION2. Actual Vulnerability Scanning
Problem: Security workflow mentioned "consider using Trivy" but didn't actually scan images.
Solution:
3. Unit Test Execution in CI
Problem: Test workflow only validated configuration but didn't run actual tests.
Solution:
unit-testsjob that runs tests for Python, Go, and Rustcontinue-on-errorsince some require running servicesTest plan