docs(audit): record Round 5 - non-root runner and secret-proof dockerignore - #75
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the audit report documentation to mark the runner stage security hardening (HI-12) as fixed in Round 5, detailing the transition to a non-root user and the addition of secret patterns to .dockerignore. Feedback on these changes suggests replacing slash separators with commas when listing the ignored file patterns in the text to prevent any confusion with nested directory paths.
| <tr><td><span class="badge b-crit">ĐÃ FIX (Round 3)</span></td><td>HI-06, HI-11, HI-14 (phần hardening), HI-02/03, HI-21, HI-22, MD-10/11/12, MD-13/14/15, MD-01</td><td>Cron auth timing-safe fail-closed (7 routes); reminder re-check booking + cancel stale reminders; rate limit 6 auth mutations + HSTS/CSP headers; MCP tenant scoping + fromReschedule + conflict guard; SSRF self-hosted + opt-out; video token fail-closed; timing-safe webhook compares</td></tr> | ||
| <tr><td><span class="badge b-crit">ĐÃ FIX (Round 4 - verify lại 2026-09-16)</span></td><td>MD-03, MD-05/06, LO-02, LO-03, MD-29</td><td>MD-03: PBAC checkPermission giờ query membership thật, throw FORBIDDEN (aa68fd3acc). MD-05/06: partial expression index trên metadata dosOrgId/dosTeamId + WebhookScheduledTriggers drain take:100 + await + deleteMany sau dispatch (efb232e52f). LO-02: 3 barrels chết đã xoá (a058d89d53). LO-03: restore membership ADMIN/OWNER check (aa68fd3acc). MD-29: fork env vars vào turbo globalEnv (ccf9b85785)</td></tr> | ||
| <tr><td><span class="badge b-crit">ĐÃ FIX (Round 4 - 2026-09-16)</span></td><td>HI-09, CR-08 (hoàn tất), LO-13 (một phần)</td><td>HI-09: workflow mới <code>fork-ci.yml</code> (type-check + lint + unit test) chạy trên PR + push dev/main của DOS/Crove-Cal; <code>deploy-docker.yml</code> thêm job <code>ci-gate</code> (type-check) mà build-and-push phải chờ. CR-08: Dockerfile/docker-compose bỏ default secret từ Round trước; Round 4 thay 4 giá trị secret thật trong <code>apps/api/v2/.env.example</code> bằng placeholder. LO-13: JWT example trong README-PLATFORM.md thay bằng placeholder</td></tr> | ||
| <tr><td><span class="badge b-crit">ĐÃ FIX (Round 5 - 2026-09-16, PR #74)</span></td><td>HI-12 phần runner</td><td>Runner stage chạy <code>USER node</code> (app tree copy với <code>--chown=node:node</code>, không tạo layer copy-up) sau bước apt chạy root; <code>.dockerignore</code> chặn <code>.env*</code>/<code>*.pem</code>/<code>*.key</code>/<code>*.p12</code>/<code>*.pfx</code>/<code>.husky</code> - bảo vệ cả image web lẫn api/v2 (cùng context root). Verify: <code>docker build --check</code> sạch (4 warning là ARG build-time placeholder đã xử lý ở CR-08), image build + publish sau gate thành công trên dev (run 35127273831)</td></tr> |
There was a problem hiding this comment.
Using / as a separator between file patterns (e.g., <code>.env*</code>/<code>*.pem</code>/...) can be confusing in a Docker/security context, as / is the standard directory separator in path patterns. A reader might misinterpret this as a nested path pattern like .env*/*.pem (which matches files inside a directory). Using commas as separators would be much clearer and prevent any ambiguity.
| <tr><td><span class="badge b-crit">ĐÃ FIX (Round 5 - 2026-09-16, PR #74)</span></td><td>HI-12 phần runner</td><td>Runner stage chạy <code>USER node</code> (app tree copy với <code>--chown=node:node</code>, không tạo layer copy-up) sau bước apt chạy root; <code>.dockerignore</code> chặn <code>.env*</code>/<code>*.pem</code>/<code>*.key</code>/<code>*.p12</code>/<code>*.pfx</code>/<code>.husky</code> - bảo vệ cả image web lẫn api/v2 (cùng context root). Verify: <code>docker build --check</code> sạch (4 warning là ARG build-time placeholder đã xử lý ở CR-08), image build + publish sau gate thành công trên dev (run 35127273831)</td></tr> | |
| <tr><td><span class="badge b-crit">ĐÃ FIX (Round 5 - 2026-09-16, PR #74)</span></td><td>HI-12 phần runner</td><td>Runner stage chạy <code>USER node</code> (app tree copy với <code>--chown=node:node</code>, không tạo layer copy-up) sau bước apt chạy root; <code>.dockerignore</code> chặn <code>.env*</code>, <code>*.pem</code>, <code>*.key</code>, <code>*.p12</code>, <code>*.pfx</code>, <code>.husky</code> - bảo vệ cả image web lẫn api/v2 (cùng context root). Verify: <code>docker build --check</code> sạch (4 warning là ARG build-time placeholder đã xử lý ở CR-08), image build + publish sau gate thành công trên dev (run 35127273831)</td></tr> |
1 participant
Records PR #74 (HI-12 remainder: USER node + .dockerignore secrets) as Round 5 in the audit report status table and the HI-12 finding note. Remaining HI-12 items are now only action SHA pinning (MD-28) and a turbo prune to drop dev deps from the image.
🤖 Generated by ZCode