Copa hardened fixes - #260

Merged

bluvulture merged 10 commits into

5.xfrom

copa-hardened-fixes

Jul 27, 2026

Commits on Jul 21, 2026

release: pin Trivy Java DB to ghcr + retry transient Trivy failures

bluvulture
and
claude
committed
90db1fb
Un-park Known-CVEs report spec + plan (implementing now)

bluvulture
and
claude
committed
d76a122
Add known-CVEs report generator (fixed/residual, per-arch) with fixture tests
bluvulture
committed
1a26df4
generate-cve-report: key fixed-CVE detection on id+package (exact), surface jq errors
bluvulture
committed
70592e3
release.yml: capture push digests and collect per-image CVE report data
bluvulture
committed
3fb1c9d
release: make CVE-report Collect non-fatal (consistent with the non-fatal gate)

bluvulture
and
claude
committed
5b3cd6d
release.yml: add publish-cve-report job committing docs/known-cves.md
bluvulture
committed
ef4a324
release: continue-on-error on CVE-report artifact download (reach the no-data skip)

bluvulture
and
claude
committed
100cf2e
README: add Known CVEs section + SBOM discovery/retrieval examples
bluvulture
committed
417c3f0
cve-report: reach no-data skip; collision-safe dedup key; locale-stable sort

bluvulture
and
claude
committed
9db8292