[vanna-cloud]

Completed the Week 7 AlertDesk containerization and deployment work.

This PR includes:

• Added a non-root Dockerfile
• Added Docker ignore configuration
• Added Compose configuration with persistent SQLite storage
• Added deployment documentation
• Updated the AlertDesk README
• Documented the database migration requirement

Tests:

• 7 tests passed

Note:

• Docker image build could not be run locally because Docker was not installed in the development environment.

[Copilot]

🟡 Changes recommended

Workflow documentation is inaccurate, the audit table is incorrectly described as append-only, and runtime logging falls outside the stated PR scope.

4 open findings

• Do not claim audit_events is append-only · New
• Document or separate global request logging change · New
• Complete workflow branches and close the code fence · New
• Document direct-to-closed workflow transitions · New

What changed in this PR

Adds AlertDesk container deployment with persistent SQLite storage, while also introducing observability, benchmarking, expanded documentation, and authentication tests.

Changes:

• Adds non-root Docker and Compose deployment.
• Adds request logging and benchmarking support.
• Expands tests, API specifications, security guidance, and deployment documentation.

File	Description
alertdesk/​.dockerignore	Excludes development artifacts from images.
alertdesk/​Dockerfile	Builds a non-root application image.
alertdesk/​compose.yaml	Runs the API with persistent storage.
alertdesk/​README.md	Documents Compose startup.
alertdesk/​SECURITY.md	Defines the security policy.
alertdesk/​alertdesk/​app.py	Enables request logging.
alertdesk/​alertdesk/​observability.py	Implements structured HTTP logs.
alertdesk/​scripts/​benchmark.py	Measures API latency.
alertdesk/​tests/​test_auth.py	Expands authorization and validation tests.
alertdesk/​docs/​BENCHMARKS.md	Documents benchmarking and logging.
alertdesk/​docs/​DEPLOYMENT.md	Documents deployment and migrations.
alertdesk/​docs/​SECURITY_ASSESSMENT.md	Assesses scaffold security risks.
alertdesk/​docs/​SPEC.md	Defines API and workflow behavior.
alertdesk/​docs/​functional_requirements	Records functional requirements.
alertdesk/​docs/​openapi.json	Exports the OpenAPI contract.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[skodie-genkey]

Request changes

The image runs as the unprivileged app user. Compose mounts a named volume at /app/data, which is where ALERTDESK_DB defaults. docs/DEPLOYMENT.md says this release adds no column and sketches how a later migration should behave. .dockerignore keeps tests, virtualenvs, and SQLite files out of the build context.

Two gaps block the week:

• The existing container-scan job already builds alertdesk/Dockerfile and fails Trivy on HIGH and CRITICAL. Its branch filter is intern/**. This PR targets interns/Evelyn-Banin, so that job does not run. Add interns/**, which is what the ConfigMaster Week 7 workflow does.
• The PR says Docker was not installed, so the image and the volume have never been started. Run docker compose up --build and confirm the app user can create data/alertdesk.sqlite on a fresh volume.

This branch again includes the earlier AlertDesk weeks and does not include the Week 6 architecture commit from PR 14.

[skodie-genkey]

The container-scan job in .github/workflows/alertdesk.yml only runs for intern/**. This PR targets interns/Evelyn-Banin, so Trivy does not run here. Add interns/** to the push and pull_request branch filters. Also run docker compose up --build once and confirm the app user can create the SQLite file on a fresh volume; the description says Docker was not available when this was written.

[vanna-cloud]

I also fixed the GitHub Actions workflow configuration. The latest workflow run (#90) is currently awaiting maintainer approval.

Could you please approve the workflow run so the tests and container scan can execute?

Thank you.

[vanna-cloud]

I also fixed the GitHub Actions workflow configuration. The latest workflow run (#90) is currently awaiting maintainer approval.

Could you please approve the workflow run so the tests and container scan can execute?

Thank you.

[vanna-cloud]

please could you approve GitHub Actions workflow run #90 for my AlertDesk Week 7 PR #17? It is currently awaiting maintainer approval, so the tests and container scan have not executed yet.

[Copilot]

🟡 Changes recommended

The API exposes ticket access on all host interfaces using publicly committed tokens, and audit events can still be overwritten via INSERT OR REPLACE despite append-only protections.

3 open issues

• Bind the API to loopback by default · New
• Document or separate global request logging change
• Do not claim audit_events is append-only

1 previously missed issue

In code that hasn't changed since last review

Block audit ID replacement on insert

alertdesk/​alertdesk/​db.py:60

INSERT OR REPLACE with an existing audit ID can overwrite an audit event because SQLite does not fire the implicit deletion's DELETE trigger with the current connection settings. This bypasses the new append-only protection even though direct UPDATE and DELETE operations are blocked. Add a BEFORE INSERT trigger that rejects existing audit IDs so replacement is blocked without relying on each writer's connection settings.

2 resolved since last review

• Document direct-to-closed workflow transitions
• Complete workflow branches and close the code fence

_{Review effort: Balanced}