Copa hardened fixes - #260

Merged

bluvulture merged 10 commits into

5.xfrom

copa-hardened-fixes

Jul 27, 2026

Commits on Jul 21, 2026

release: pin Trivy Java DB to ghcr + retry transient Trivy failures

bluvulture
and
claude
committed
Un-park Known-CVEs report spec + plan (implementing now)

bluvulture
and
claude
committed
Add known-CVEs report generator (fixed/residual, per-arch) with fixture tests
bluvulture
committed
generate-cve-report: key fixed-CVE detection on id+package (exact), surface jq errors
bluvulture
committed
release.yml: capture push digests and collect per-image CVE report data
bluvulture
committed
release: make CVE-report Collect non-fatal (consistent with the non-fatal gate)

bluvulture
and
claude
committed
release.yml: add publish-cve-report job committing docs/known-cves.md
bluvulture
committed
release: continue-on-error on CVE-report artifact download (reach the no-data skip)

bluvulture
and
claude
committed
README: add Known CVEs section + SBOM discovery/retrieval examples
bluvulture
committed
cve-report: reach no-data skip; collision-safe dedup key; locale-stable sort

bluvulture
and
claude
committed