Repository navigation
role_shadows: refuse to allowlist LIVE findings - #2831
Merged
Merged
Conversation
A LIVE role_shadows finding means no release transport overrides the role default, so the role default is what deploys. Every role_shadows finding is for an image that base.yml pins, so allowlisting a LIVE one leaves the release stating a version that never reaches a deployment, and the drift check stays green about it. role_shadows now applies the allowlist to DORMANT findings only. A LIVE finding that matches an entry stays actionable and is reported in its own block: the entry cannot apply. The fix is either to carry the tag in container-image-osism-ansible's versions.yml.j2, or, for an image that is role-managed by design, to remove its base.yml pin and allowlist it under role_unpinned. Because the entry still matches its finding, it is reported there rather than as a stale entry. Two driver tests allowlisted the fixture's LIVE findings to get an advisory-only run. They now pass a --base-dir overlay whose versions.yml.j2 carries those two aliases, which turns them DORMANT. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
ideaship
marked this pull request as ready for review
October 14, 2026 04:53
This was referenced Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
role_shadowsno longer lets an allowlist entry silence a LIVE finding, meaning one where the role default is what actually deploys. Everyrole_shadowsfinding is for an image thatbase.ymlpins, so a silenced LIVE finding leaves the release stating a version that never deploys. A matching entry is now reported on the finding, which stays actionable. The finding names the two real fixes: carry the tag in container-image-osism-ansible'sversions.yml.j2, or remove thebase.ymlpin and allowlist the image underrole_unpinned. DORMANT findings can still be allowlisted.Against current sources the guard reports two findings. Both are allowlisted in
src/drift-allowlist.ymltoday (since 07b5f78):The image drift check exits 1 until they are resolved. The fix (carry
homer_tag/nexus_tagin container-image-osism-ansible'sversions.yml.j2, then drop the two allowlist entries) will follow in a separate PR.🤖 Generated with Claude Code