release: ship GuardScan 1.1.0 through the zero-touch release train - #32
release: ship GuardScan 1.1.0 through the zero-touch release train#32ntanwir10 wants to merge 11 commits into
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
guardscan-backend | c787d6e | Jul 26 2026, 04:47 AM |
|
Important Review skippedToo many files! This PR contains 245 files, which is 145 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (245)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
💡 Codex ReviewGuardScan/cli/src/core/package-inventory.ts Lines 249 to 250 in e6de48f  Support Yarn Modern's colon-delimited version field
For a Yarn Modern lockfile, entries use GuardScan/cli/src/core/dependency-scanner.ts Lines 226 to 229 in e6de48f  Keep scanning after an unsupported CVSS vector
When an OSV severity array contains an unsupported or malformed CVSS vector before a valid CVSS 3.0/3.1 entry, this unconditional return stops processing the remaining entries. If the advisory has no qualitative severity fallback, a later high or critical score is therefore classified as unknown and reduced to the medium policy default, allowing GuardScan/cli/src/core/dependency-scanner.ts Lines 529 to 533 in e6de48f Preserve inventory errors when no coordinates resolve
When every dependency is unresolved or malformed and GuardScan/cli/src/core/test-runner.ts Lines 140 to 141 in e6de48f Count Jest suite-level failures
When Jest fails a suite before running assertions—for example because a test file has a syntax error or cannot import a module—the JSON report contains a failed suite with an empty GuardScan/cli/src/core/test-runner.ts Lines 260 to 265 in e6de48f Treat pytest collection errors as execution failures
If pytest writes its JSON report but exits during collection or initialization, GuardScan/cli/src/core/test-runner.ts Lines 363 to 368 in e6de48f Fail Go test runs on package-level failures
For compilation, setup, or package-level GuardScan/cli/src/core/package-inventory.ts Lines 342 to 345 in e6de48f Report unresolved Maven property versions
Maven projects commonly declare exact dependency versions through local properties such as GuardScan/cli/src/core/vulnerability-cache.ts Lines 315 to 320 in e6de48f Bind offline snapshots to the configured OSV endpoint
After an online snapshot is created from one OSV endpoint, changing GuardScan/cli/src/core/license-scanner.ts Lines 744 to 750 in e6de48f Preserve dependency scope in CycloneDX components
The inventory distinguishes runtime, development, and optional dependencies, but that scope is dropped when creating ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
What changed
ntanwir10/homebrew-tapcatalog for both Homebrew and Scoop, generated from an immutable GuardScan release manifest and kept in sync through pull requests plus scheduled reconciliationWhy
The previous release scaffold could not prove native artifacts, cross-channel identity, promotion timing, moderated-provider state, or safe recovery. This release makes GuardScan the single release authority and treats every downstream package definition as a reproducible projection of the same immutable manifest.
Validation at
773a824npm test -- --runInBand --silent— 73 suites, 846 testsnpm run test:release— 8 suites, 102 testsnpm run typechecknpm run lint:ratchetnpm audit --audit-level=high— 0 vulnerabilitiesnpm run test:packagenpm pack --dry-run— 529 files, 732.5 kB packed, 3.9 MB unpackedgit diff --checkHosted checks for the current head are intentionally required before this draft becomes mergeable.
Known unrelated external check
Workers Builds: guardscan-backendis a stale Cloudflare Git integration. It still targets this repository with root directorybackend, but that directory was intentionally moved to the privatentanwir10/GuardScan-Monitoringrepository in commitcfdc95a. Disconnecting or rewiring that external integration remains separate from this release-train PR.External onboarding still required
Publication remains fail-closed with
RELEASE_AUTOMATION_ENABLED=falseuntil the inert default-branch bootstrap, GitHub App permissions, OIDC trusted publishers, signing identities, moderated-registry credentials, and rehearsals indocs/RELEASE_ONBOARDING.mdare complete. No package publication is authorized by merging this draft alone.