Skip to content

Develop#1080

Merged
GrammaTonic merged 20 commits intomainfrom
develop
Dec 18, 2025
Merged

Develop#1080
GrammaTonic merged 20 commits intomainfrom
develop

Conversation

@GrammaTonic
Copy link
Owner

📋 Pull Request Description

🔀 Merge Strategy

This repository uses SQUASH MERGE as the standard merge strategy.

Why Squash Merge?

  • Clean, linear commit history on main branch - easier to understand project evolution
  • One commit per feature/fix - easier rollbacks and cherry-picking
  • Better release notes - automated changelog generation from squashed commits
  • Simplified CI/CD - cleaner git history for automated release processes
  • Consistent with Dependabot - auto-merge configuration uses squash strategy
  • Reduced noise - no "fix typo" or "address review comments" commits in main
  • Easier bisecting - each commit represents a complete, logical change

How to Create a PR (Recommended):

# Create PR using a markdown file for detailed description
gh pr create --base develop --fill-first --body-file .github/pull_request_template.md

# Or for quick PRs with inline body:
gh pr create --base develop --title "feat: your feature title" --body "Description here"

# For promotion PRs (develop → main):
gh pr create --base main --head develop --title "chore: promote develop to main" --body-file PR_DESCRIPTION.md

How to Merge (Recommended):

# Via GitHub CLI (recommended - ensures squash merge):
gh pr merge <PR_NUMBER> --squash --delete-branch --body "Squash merge: <brief summary>"

# Via GitHub Web UI:
# 1. Click "Squash and merge" button (NOT "Merge pull request" or "Rebase and merge")
# 2. Edit the commit message if needed
# 3. Confirm the merge
# 4. Delete the branch

⚠️ CRITICAL: After squash merging to main, you MUST back-sync develop (see Post-Merge Back-Sync section below).

⚠️ Pre-Submission Checklist

Branch Sync Requirements:

  • I have pulled the latest changes from main branch: git pull origin main
  • I have pulled the latest changes from develop branch: git pull origin develop
  • I have rebased my feature branch on the target branch (if applicable)
  • My branch is up-to-date with no merge conflicts

Quick sync commands:

# Fetch all remote branches
git fetch --all

# Update local main branch
git checkout main
git pull origin main

# Update local develop branch
git checkout develop
git pull origin develop

# Return to your feature branch and rebase (if needed)
git checkout <your-feature-branch>
git rebase develop  # or 'main' depending on your target branch

Post-Merge Back-Sync (CRITICAL after squash merging to main):

⚠️ MANDATORY STEP - DO NOT SKIP THIS!

Why is this needed?
When you squash merge a PR from develop to main, the individual commits from develop are condensed into a single commit on main. This causes develop to appear "ahead" of main in git history, even though the code is identical. The back-sync merge resolves this divergence and prevents:

  • ❌ Incorrect "X commits ahead" status on develop
  • ❌ Merge conflicts on subsequent PRs
  • ❌ CI/CD pipeline confusion
  • ❌ Duplicate commits in future merges

When to perform back-sync:

  • ALWAYS after merging a promotion PR (developmain) with squash merge
  • ALWAYS after merging any PR directly to main with squash merge
  • IMMEDIATELY after the squash merge completes (don't wait!)
  • ❌ NOT needed when merging feature branches to develop (develop will be promoted later)

How to perform back-sync:

# Step 1: Ensure your local branches are up-to-date
git fetch --all

# Step 2: Switch to develop and pull latest
git checkout develop
git pull origin develop

# Step 3: Merge main back into develop (creates a merge commit)
git merge main -m "chore: sync develop with main after squash merge"

# Step 4: Push the back-sync to remote
git push origin develop

# This ensures develop stays in sync with main after squash merges
# The merge commit preserves the development history in develop
# while keeping main's linear squashed history

Alternative (using GitHub CLI):

# Create a back-sync PR (for teams requiring PR workflow)
git checkout develop
git pull origin develop
git checkout -b chore/backsync-main-to-develop
git merge main -m "chore: sync develop with main after squash merge"
git push origin chore/backsync-main-to-develop
gh pr create --base develop --head chore/backsync-main-to-develop \
  --title "chore: back-sync main to develop after squash merge" \
  --body "Automatic back-sync after squash merging to main. This prevents 'ahead' status."
gh pr merge --merge --delete-branch  # Use regular merge, not squash!

Verification:

# After back-sync, these commands should show no differences:
git diff main..develop  # Should be empty (no code differences)
git log --oneline main..develop  # Should only show merge commits (no unique commits)

# Check branch status (should show "up to date"):
git checkout develop
git status
# Should NOT say "Your branch is ahead of 'origin/develop'"

Troubleshooting:

# If you forgot to back-sync and now have conflicts:
git checkout develop
git pull origin develop
git fetch origin main
git merge origin/main -m "chore: late back-sync after squash merge"
# Resolve any conflicts, then:
git push origin develop

Summary

Type of Change

  • 🐛 Bug fix (non-breaking change which fixes an issue)
  • ✨ New feature (non-breaking change which adds functionality)
  • 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • 📚 Documentation update
  • 🔧 Configuration change
  • 🧪 Test improvements
  • 🚀 Performance improvement
  • 🔒 Security enhancement

Related Issues

  • Fixes #
  • Related to #

🔄 Changes Made

Files Modified

  • file1.ext - Description of changes
  • file2.ext - Description of changes

Key Changes

🧪 Testing

Testing Performed

  • Unit tests pass
  • Integration tests pass
  • Manual testing completed
  • Docker build successful
  • Chrome runner tested (if applicable)

Test Coverage

  • New tests added for new functionality
  • Existing tests updated
  • All tests are passing

Manual Testing Steps

📸 Screenshots/Demos

🔒 Security Considerations

  • No new security vulnerabilities introduced
  • Secrets/tokens handled appropriately
  • Container security best practices followed

📚 Documentation

  • README.md updated
  • Documentation in docs/ updated
  • Wiki pages updated
  • Code comments added/updated
  • API documentation updated

🚀 Deployment Notes

  • No deployment changes required
  • Docker image rebuild required
  • Environment variables updated
  • Configuration changes needed

✅ Checklist

  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published

🤖 AI Review Request

/cc @copilot


Note for Reviewers:

  • Please review the code for functionality, security, and maintainability
  • Check that documentation is updated appropriately
  • Verify that tests are comprehensive and passing
  • Consider the impact on existing workflows and deployments

GrammaTonic and others added 19 commits November 16, 2025 20:13
- Add detailed squash merge benefits (7 key advantages)
- Include recommended gh pr create commands with markdown file usage
- Add explicit merge instructions for CLI and Web UI
- Expand back-sync section with mandatory warnings and step-by-step guide
- Add alternative back-sync method using GitHub CLI
- Include verification commands and troubleshooting steps
- Apply updates to both AI instructions and actual PR template
- Ensure consistency between Copilot guidance and user-facing template

This update ensures all PRs display comprehensive squash merge and back-sync
instructions, preventing common issues like 'ahead' status and merge conflicts.
Phase 1 implementation complete with all code tasks validated. Testing to be completed in develop branch.
….28.0 to 0.33.1

Automatically merged Dependabot PR after CI validation.
Automatically merged Dependabot PR after CI validation.
Automatically merged Dependabot PR after CI validation.
- Update Go version from 1.25.4 to 1.25.5 in Dockerfile.chrome-go
- Fixes HIGH severity vulnerability in stdlib HostnameError.Error()
- Prevents excessive resource consumption from malicious certificates
- Resolves quadratic runtime issue in error string construction

Fixes: CVE-2025-61729
Related: https://github.com/GrammaTonic/github-runner/security/code-scanning/5682
Back-sync after PR #1073 (CVE-2025-61729 security fix) was merged to main.
This prevents develop from appearing ahead of main and ensures branches stay synchronized.
- Update NPM_VERSION from 11.6.2 to 11.6.4 in Chrome and Chrome-Go Dockerfiles
- Fixes HIGH severity vulnerability in glob (npm dependency)
- npm 11.6.4 depends on glob ^13.0.0 (vs vulnerable 11.0.3)
- Resolves command injection vulnerability in glob's -c/--cmd option
- Prevents arbitrary code execution via malicious filenames

Vulnerability Details:
- CVE ID: CVE-2025-64756
- Severity: HIGH
- Affected Package: glob 11.0.3 (npm internal dependency)
- Fixed Versions: glob 11.1.0, 10.5.0 (npm 11.6.4 uses glob 13.0.0)
- Issue: Command injection via shell metacharacters in filenames
- Link: https://avd.aquasec.com/nvd/cve-2025-64756

Fixes: https://github.com/GrammaTonic/github-runner/security/code-scanning/5665
- Change VALIDATE_ALL_CODEBASE from true to false (only validate changed files)
- Disable SAVE_SUPER_LINTER_OUTPUT to reduce artifact size
- Disable VALIDATE_MD to reduce processing overhead
- Expand FILTER_REGEX_EXCLUDE to skip docs and plan directories

This reduces the Super-Linter job size and prevents image size issues
while maintaining validation of critical files (Dockerfiles, bash, YAML, JSON).

Fixes: https://github.com/GrammaTonic/github-runner/actions/runs/19948737687/job/57204156543
- Replace super-linter/super-linter with individual focused actions
- Use hadolint/hadolint-action for Dockerfile linting
- Use ludeeus/action-shellcheck for shell script validation
- Use ibiqlik/action-yamllint for YAML validation
- Add .yamllint.yml configuration file

Benefits:
- Significantly smaller action images (no 8GB+ Super-Linter image)
- Faster execution with parallel specialized linters
- More granular control over linting rules
- Reduced CI/CD resource consumption
- Better caching and incremental builds

Fixes: https://github.com/GrammaTonic/github-runner/actions/runs/19948737687/job/57204156543
- Add 15-minute timeout for container scans (10m for filesystem)
- Filter to CRITICAL and HIGH severity only to reduce scan time
- Skip unnecessary directories (test-results, logs, .git)
- Prevents PROTOCOL_ERROR from layer extraction timeouts

This resolves the stream ID protocol errors when scanning large
Docker images (Chrome/Chrome-Go runners with browsers and dependencies).

Fixes: stream error: stream ID 17; PROTOCOL_ERROR; received from peer
- Remove cmd/metrics-exporter/main.go (experimental Prometheus metrics collector)
- Remove go.mod and go.sum (no longer needed without Go code)
- This feature was not production-ready and conflicted with documented netcat-based metrics approach
- Reduces codebase complexity and maintenance burden

Part of CI/CD optimization effort after CVE-2025-61729 and CVE-2025-64756 security fixes.
* feat: upgrade GitHub Actions runner to 2.330.0

- Update RUNNER_VERSION from 2.329.0 to 2.330.0 in all Dockerfiles
- Standard runner: docker/Dockerfile
- Chrome runner: docker/Dockerfile.chrome
- Chrome-Go runner: docker/Dockerfile.chrome-go

Runner 2.330.0 includes:
- Updated Node.js versions
- Custom image preflight checks
- Improved logic for IsHostedServer detection
- Docker v29.0.1 and Buildx v0.30.0 support
- Retry logic for DNS resolution failures
- Network-online dependency for runner service

Release notes: https://github.com/actions/runner/releases/tag/v2.330.0

* fix: update runtime stage RUNNER_VERSION to 2.330.0

Ensure consistency between builder and runtime stages in multi-stage Dockerfile.

---------

Co-authored-by: Syam Sampatsing <grammatonic@mbp-van-syam.home>
…1.0 to 3.3.0

Automatically merged Dependabot PR after CI validation.
Automatically merged Dependabot PR after CI validation.
* Initial plan

* fix: replace broken free-disk-space action with manual cleanup

Replace jlumbroso/free-disk-space-action@v1.3.1 with manual disk cleanup script.
The original action repository is no longer accessible (404/403 errors), causing
Dependabot failures. The manual approach achieves the same disk space cleanup
by removing dotnet, android, haskell toolchains and boost libraries.

This fixes the git_dependencies_not_reachable error for Dependabot and allows
the security advisory workflow to continue functioning properly.

Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>
@gemini-code-assist
Copy link

Summary of Changes

Hello @GrammaTonic, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the version of the runner used in the project's Docker build configurations. The primary goal is to leverage the latest runner version, which may include new features, bug fixes, or performance enhancements, thereby ensuring that all containerized builds are up-to-date with the most recent tooling.

Highlights

  • Runner Version Update: The RUNNER_VERSION has been incremented across multiple Dockerfiles to ensure the latest runner is utilized.
  • Version Bump: The runner version has been updated from 2.329.0 to 2.330.0 in all relevant Docker build configurations.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files
  • Ignored by pattern: .github/workflows/** (8)
    • .github/workflows/auto-sync-docs.yml
    • .github/workflows/ci-cd.yml
    • .github/workflows/docs-validation.yml
    • .github/workflows/maintenance.yml
    • .github/workflows/monitoring.yml
    • .github/workflows/release.yml
    • .github/workflows/security-advisories.yml
    • .github/workflows/seed-trivy-sarif.yml
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

Copy link

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the GitHub Actions runner version to 2.330.0. The changes in the Dockerfiles are correct. However, I've noticed that this version number is also present in documentation and build scripts, which have not been updated. I've left a comment with the specific files and line numbers that require changes to ensure consistency across the repository.

- Update VERSION_OVERVIEW.md to reflect runner version 2.330.0
- Update default RUNNER_VERSION in build.sh to 2.330.0
- Update default RUNNER_VERSION in build-chrome.sh to 2.330.0

Ensures consistency across Dockerfiles, documentation, and build scripts.
Addresses review comment from PR #1080.
@GrammaTonic GrammaTonic merged commit 20817bc into main Dec 18, 2025
41 checks passed
GrammaTonic added a commit that referenced this pull request Dec 18, 2025
* docs: enhance PR template with comprehensive squash merge workflow

- Add detailed squash merge benefits (7 key advantages)
- Include recommended gh pr create commands with markdown file usage
- Add explicit merge instructions for CLI and Web UI
- Expand back-sync section with mandatory warnings and step-by-step guide
- Add alternative back-sync method using GitHub CLI
- Include verification commands and troubleshooting steps
- Apply updates to both AI instructions and actual PR template
- Ensure consistency between Copilot guidance and user-facing template

This update ensures all PRs display comprehensive squash merge and back-sync
instructions, preventing common issues like 'ahead' status and merge conflicts.

* feat(prometheus): Phase 1 - Standard Runner Metrics Endpoint (#1066)

Phase 1 implementation complete with all code tasks validated. Testing to be completed in develop branch.

* chore(deps): chore(deps)(deps): bump aquasecurity/trivy-action from 0.28.0 to 0.33.1

Automatically merged Dependabot PR after CI validation.

* chore(deps): chore(deps)(deps): bump actions/upload-artifact from 4 to 5

Automatically merged Dependabot PR after CI validation.

* chore(deps): chore(deps)(deps): bump actions/checkout from 5 to 6

Automatically merged Dependabot PR after CI validation.

* fix(security): upgrade Go to 1.25.5 to fix CVE-2025-61729

- Update Go version from 1.25.4 to 1.25.5 in Dockerfile.chrome-go
- Fixes HIGH severity vulnerability in stdlib HostnameError.Error()
- Prevents excessive resource consumption from malicious certificates
- Resolves quadratic runtime issue in error string construction

Fixes: CVE-2025-61729
Related: https://github.com/GrammaTonic/github-runner/security/code-scanning/5682

* fix(security): upgrade npm to 11.6.4 to fix CVE-2025-64756

- Update NPM_VERSION from 11.6.2 to 11.6.4 in Chrome and Chrome-Go Dockerfiles
- Fixes HIGH severity vulnerability in glob (npm dependency)
- npm 11.6.4 depends on glob ^13.0.0 (vs vulnerable 11.0.3)
- Resolves command injection vulnerability in glob's -c/--cmd option
- Prevents arbitrary code execution via malicious filenames

Vulnerability Details:
- CVE ID: CVE-2025-64756
- Severity: HIGH
- Affected Package: glob 11.0.3 (npm internal dependency)
- Fixed Versions: glob 11.1.0, 10.5.0 (npm 11.6.4 uses glob 13.0.0)
- Issue: Command injection via shell metacharacters in filenames
- Link: https://avd.aquasec.com/nvd/cve-2025-64756

Fixes: https://github.com/GrammaTonic/github-runner/security/code-scanning/5665

* fix(ci): optimize Super-Linter to reduce image size overhead

- Change VALIDATE_ALL_CODEBASE from true to false (only validate changed files)
- Disable SAVE_SUPER_LINTER_OUTPUT to reduce artifact size
- Disable VALIDATE_MD to reduce processing overhead
- Expand FILTER_REGEX_EXCLUDE to skip docs and plan directories

This reduces the Super-Linter job size and prevents image size issues
while maintaining validation of critical files (Dockerfiles, bash, YAML, JSON).

Fixes: https://github.com/GrammaTonic/github-runner/actions/runs/19948737687/job/57204156543

* fix(ci): replace Super-Linter with lightweight GitHub Actions

- Replace super-linter/super-linter with individual focused actions
- Use hadolint/hadolint-action for Dockerfile linting
- Use ludeeus/action-shellcheck for shell script validation
- Use ibiqlik/action-yamllint for YAML validation
- Add .yamllint.yml configuration file

Benefits:
- Significantly smaller action images (no 8GB+ Super-Linter image)
- Faster execution with parallel specialized linters
- More granular control over linting rules
- Reduced CI/CD resource consumption
- Better caching and incremental builds

Fixes: https://github.com/GrammaTonic/github-runner/actions/runs/19948737687/job/57204156543

* fix(ci): add Trivy scan resilience settings for large images

- Add 15-minute timeout for container scans (10m for filesystem)
- Filter to CRITICAL and HIGH severity only to reduce scan time
- Skip unnecessary directories (test-results, logs, .git)
- Prevents PROTOCOL_ERROR from layer extraction timeouts

This resolves the stream ID protocol errors when scanning large
Docker images (Chrome/Chrome-Go runners with browsers and dependencies).

Fixes: stream error: stream ID 17; PROTOCOL_ERROR; received from peer

* refactor: remove experimental Go metrics exporter

- Remove cmd/metrics-exporter/main.go (experimental Prometheus metrics collector)
- Remove go.mod and go.sum (no longer needed without Go code)
- This feature was not production-ready and conflicted with documented netcat-based metrics approach
- Reduces codebase complexity and maintenance burden

Part of CI/CD optimization effort after CVE-2025-61729 and CVE-2025-64756 security fixes.

* feat: upgrade GitHub Actions runner to 2.330.0 (#1075)

* feat: upgrade GitHub Actions runner to 2.330.0

- Update RUNNER_VERSION from 2.329.0 to 2.330.0 in all Dockerfiles
- Standard runner: docker/Dockerfile
- Chrome runner: docker/Dockerfile.chrome
- Chrome-Go runner: docker/Dockerfile.chrome-go

Runner 2.330.0 includes:
- Updated Node.js versions
- Custom image preflight checks
- Improved logic for IsHostedServer detection
- Docker v29.0.1 and Buildx v0.30.0 support
- Retry logic for DNS resolution failures
- Network-online dependency for runner service

Release notes: https://github.com/actions/runner/releases/tag/v2.330.0

* fix: update runtime stage RUNNER_VERSION to 2.330.0

Ensure consistency between builder and runtime stages in multi-stage Dockerfile.

---------

Co-authored-by: Syam Sampatsing <grammatonic@mbp-van-syam.home>

* chore(deps): chore(deps)(deps): bump hadolint/hadolint-action from 3.1.0 to 3.3.0

Automatically merged Dependabot PR after CI validation.

* fix: resolve disk space exhaustion in security scan workflow (#1077)

* chore(deps): chore(deps)(deps): bump actions/upload-artifact from 5 to 6

Automatically merged Dependabot PR after CI validation.

* fix: replace broken free-disk-space action with manual cleanup (#1079)

* Initial plan

* fix: replace broken free-disk-space action with manual cleanup

Replace jlumbroso/free-disk-space-action@v1.3.1 with manual disk cleanup script.
The original action repository is no longer accessible (404/403 errors), causing
Dependabot failures. The manual approach achieves the same disk space cleanup
by removing dotnet, android, haskell toolchains and boost libraries.

This fixes the git_dependencies_not_reachable error for Dependabot and allows
the security advisory workflow to continue functioning properly.

Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>

* chore: update runner version to 2.330.0 in docs and build scripts

- Update VERSION_OVERVIEW.md to reflect runner version 2.330.0
- Update default RUNNER_VERSION in build.sh to 2.330.0
- Update default RUNNER_VERSION in build-chrome.sh to 2.330.0

Ensures consistency across Dockerfiles, documentation, and build scripts.
Addresses review comment from PR #1080.

* refactor: replace Go Prometheus implementation with netcat method

- Remove all Go/Prometheus client library references
- Replace with lightweight bash + netcat HTTP server approach
- Update metrics-server.sh to use netcat for serving /metrics endpoint
- Update metrics-collector.sh to generate Prometheus text format
- Remove multi-stage Docker build requirements for Go
- Update implementation tasks and design decisions
- Simplify architecture to use only bash scripting
- Update risks & mitigations for netcat approach
- Remove CGO_ENABLED and go.mod/go.sum references

Benefits:
- No additional language runtime required
- Smaller Docker image size (no Go toolchain)
- Simpler build process
- Lower resource overhead
- Easier to maintain and debug

Addresses constraint CON-001: Must use bash scripting only

* fix(security): patch CVE-2025-64756 glob vulnerability in standard runner

- Add glob 13.0.0 patching to standard Dockerfile
- Mitigate command injection vulnerability in node-gyp glob dependency
- Chrome and Chrome-Go runners already had this patching
- Uses same patching strategy as cross-spawn, tar, and brace-expansion

Fixes #5660
Closes: CVE-2025-64756

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Syam Sampatsing <grammatonic@macbookpro.home>
Co-authored-by: Syam Sampatsing <grammatonic@mbp-van-syam.home>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>
GrammaTonic added a commit that referenced this pull request Dec 18, 2025
* docs: enhance PR template with comprehensive squash merge workflow

- Add detailed squash merge benefits (7 key advantages)
- Include recommended gh pr create commands with markdown file usage
- Add explicit merge instructions for CLI and Web UI
- Expand back-sync section with mandatory warnings and step-by-step guide
- Add alternative back-sync method using GitHub CLI
- Include verification commands and troubleshooting steps
- Apply updates to both AI instructions and actual PR template
- Ensure consistency between Copilot guidance and user-facing template

This update ensures all PRs display comprehensive squash merge and back-sync
instructions, preventing common issues like 'ahead' status and merge conflicts.

* feat(prometheus): Phase 1 - Standard Runner Metrics Endpoint (#1066)

Phase 1 implementation complete with all code tasks validated. Testing to be completed in develop branch.

* chore(deps): chore(deps)(deps): bump aquasecurity/trivy-action from 0.28.0 to 0.33.1

Automatically merged Dependabot PR after CI validation.

* chore(deps): chore(deps)(deps): bump actions/upload-artifact from 4 to 5

Automatically merged Dependabot PR after CI validation.

* chore(deps): chore(deps)(deps): bump actions/checkout from 5 to 6

Automatically merged Dependabot PR after CI validation.

* fix(security): upgrade Go to 1.25.5 to fix CVE-2025-61729

- Update Go version from 1.25.4 to 1.25.5 in Dockerfile.chrome-go
- Fixes HIGH severity vulnerability in stdlib HostnameError.Error()
- Prevents excessive resource consumption from malicious certificates
- Resolves quadratic runtime issue in error string construction

Fixes: CVE-2025-61729
Related: https://github.com/GrammaTonic/github-runner/security/code-scanning/5682

* fix(security): upgrade npm to 11.6.4 to fix CVE-2025-64756

- Update NPM_VERSION from 11.6.2 to 11.6.4 in Chrome and Chrome-Go Dockerfiles
- Fixes HIGH severity vulnerability in glob (npm dependency)
- npm 11.6.4 depends on glob ^13.0.0 (vs vulnerable 11.0.3)
- Resolves command injection vulnerability in glob's -c/--cmd option
- Prevents arbitrary code execution via malicious filenames

Vulnerability Details:
- CVE ID: CVE-2025-64756
- Severity: HIGH
- Affected Package: glob 11.0.3 (npm internal dependency)
- Fixed Versions: glob 11.1.0, 10.5.0 (npm 11.6.4 uses glob 13.0.0)
- Issue: Command injection via shell metacharacters in filenames
- Link: https://avd.aquasec.com/nvd/cve-2025-64756

Fixes: https://github.com/GrammaTonic/github-runner/security/code-scanning/5665

* fix(ci): optimize Super-Linter to reduce image size overhead

- Change VALIDATE_ALL_CODEBASE from true to false (only validate changed files)
- Disable SAVE_SUPER_LINTER_OUTPUT to reduce artifact size
- Disable VALIDATE_MD to reduce processing overhead
- Expand FILTER_REGEX_EXCLUDE to skip docs and plan directories

This reduces the Super-Linter job size and prevents image size issues
while maintaining validation of critical files (Dockerfiles, bash, YAML, JSON).

Fixes: https://github.com/GrammaTonic/github-runner/actions/runs/19948737687/job/57204156543

* fix(ci): replace Super-Linter with lightweight GitHub Actions

- Replace super-linter/super-linter with individual focused actions
- Use hadolint/hadolint-action for Dockerfile linting
- Use ludeeus/action-shellcheck for shell script validation
- Use ibiqlik/action-yamllint for YAML validation
- Add .yamllint.yml configuration file

Benefits:
- Significantly smaller action images (no 8GB+ Super-Linter image)
- Faster execution with parallel specialized linters
- More granular control over linting rules
- Reduced CI/CD resource consumption
- Better caching and incremental builds

Fixes: https://github.com/GrammaTonic/github-runner/actions/runs/19948737687/job/57204156543

* fix(ci): add Trivy scan resilience settings for large images

- Add 15-minute timeout for container scans (10m for filesystem)
- Filter to CRITICAL and HIGH severity only to reduce scan time
- Skip unnecessary directories (test-results, logs, .git)
- Prevents PROTOCOL_ERROR from layer extraction timeouts

This resolves the stream ID protocol errors when scanning large
Docker images (Chrome/Chrome-Go runners with browsers and dependencies).

Fixes: stream error: stream ID 17; PROTOCOL_ERROR; received from peer

* refactor: remove experimental Go metrics exporter

- Remove cmd/metrics-exporter/main.go (experimental Prometheus metrics collector)
- Remove go.mod and go.sum (no longer needed without Go code)
- This feature was not production-ready and conflicted with documented netcat-based metrics approach
- Reduces codebase complexity and maintenance burden

Part of CI/CD optimization effort after CVE-2025-61729 and CVE-2025-64756 security fixes.

* feat: upgrade GitHub Actions runner to 2.330.0 (#1075)

* feat: upgrade GitHub Actions runner to 2.330.0

- Update RUNNER_VERSION from 2.329.0 to 2.330.0 in all Dockerfiles
- Standard runner: docker/Dockerfile
- Chrome runner: docker/Dockerfile.chrome
- Chrome-Go runner: docker/Dockerfile.chrome-go

Runner 2.330.0 includes:
- Updated Node.js versions
- Custom image preflight checks
- Improved logic for IsHostedServer detection
- Docker v29.0.1 and Buildx v0.30.0 support
- Retry logic for DNS resolution failures
- Network-online dependency for runner service

Release notes: https://github.com/actions/runner/releases/tag/v2.330.0

* fix: update runtime stage RUNNER_VERSION to 2.330.0

Ensure consistency between builder and runtime stages in multi-stage Dockerfile.

---------

Co-authored-by: Syam Sampatsing <grammatonic@mbp-van-syam.home>

* chore(deps): chore(deps)(deps): bump hadolint/hadolint-action from 3.1.0 to 3.3.0

Automatically merged Dependabot PR after CI validation.

* fix: resolve disk space exhaustion in security scan workflow (#1077)

* chore(deps): chore(deps)(deps): bump actions/upload-artifact from 5 to 6

Automatically merged Dependabot PR after CI validation.

* fix: replace broken free-disk-space action with manual cleanup (#1079)

* Initial plan

* fix: replace broken free-disk-space action with manual cleanup

Replace jlumbroso/free-disk-space-action@v1.3.1 with manual disk cleanup script.
The original action repository is no longer accessible (404/403 errors), causing
Dependabot failures. The manual approach achieves the same disk space cleanup
by removing dotnet, android, haskell toolchains and boost libraries.

This fixes the git_dependencies_not_reachable error for Dependabot and allows
the security advisory workflow to continue functioning properly.

Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>

* chore: update runner version to 2.330.0 in docs and build scripts

- Update VERSION_OVERVIEW.md to reflect runner version 2.330.0
- Update default RUNNER_VERSION in build.sh to 2.330.0
- Update default RUNNER_VERSION in build-chrome.sh to 2.330.0

Ensures consistency across Dockerfiles, documentation, and build scripts.
Addresses review comment from PR #1080.

* refactor: replace Go Prometheus implementation with netcat method

- Remove all Go/Prometheus client library references
- Replace with lightweight bash + netcat HTTP server approach
- Update metrics-server.sh to use netcat for serving /metrics endpoint
- Update metrics-collector.sh to generate Prometheus text format
- Remove multi-stage Docker build requirements for Go
- Update implementation tasks and design decisions
- Simplify architecture to use only bash scripting
- Update risks & mitigations for netcat approach
- Remove CGO_ENABLED and go.mod/go.sum references

Benefits:
- No additional language runtime required
- Smaller Docker image size (no Go toolchain)
- Simpler build process
- Lower resource overhead
- Easier to maintain and debug

Addresses constraint CON-001: Must use bash scripting only

* fix(security): patch CVE-2025-64756 glob vulnerability in standard runner

- Add glob 13.0.0 patching to standard Dockerfile
- Mitigate command injection vulnerability in node-gyp glob dependency
- Chrome and Chrome-Go runners already had this patching
- Uses same patching strategy as cross-spawn, tar, and brace-expansion

Fixes #5660
Closes: CVE-2025-64756

* chore: remove unused monitoring workflow

- Remove .github/workflows/monitoring.yml
- Workflow was not actively used in current setup
- Reduces workflow complexity and maintenance burden

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Syam Sampatsing <grammatonic@macbookpro.home>
Co-authored-by: Syam Sampatsing <grammatonic@mbp-van-syam.home>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: GrammaTonic <8269379+GrammaTonic@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants