fix(ci): reduce security findings and restore end-to-end tests by eduardoleal · Pull Request #162 · devopsfactory-io/neptune

eduardoleal · 2026-10-23T15:13:37Z

What is this feature?

Reduce Neptune's reachable security findings from 34 to 3 and restore end-to-end tests after the MinIO image pull failures. Security CI now scans both Go modules independently, keeping the unresolved dependency findings visible.

Why do we need this feature?

The remaining advisories require a compatible upstream Terramate dependency change. Forcing Terragrunt v1 breaks the SDK imports, and downgrading the SDK misses shared Terragrunt module changes. This PR preserves current stack detection while shipping the independent fixes.

Who is this feature for?

Neptune maintainers and contributors running security checks and Terraform/OpenTofu plan/apply tests.

Related issues

Related: #163 and #25

Related Renovate work: #140 and #153.

Notes for reviewers

Root govulncheck still exits 3 for GO-2026-6768, GO-2026-6241, and GO-2026-5932. Lambda govulncheck passes. No suppressions or dependency forks were added.
SECURITY.md permits maintainer tracking of already disclosed upstream advisories. New or undisclosed vulnerabilities still require private reporting.
Go 1.26.10: make test-all, make lambda.test, make check-fmt, and make lint pass. Eight Git-backed cases cover stack selection, shared modules, Terragrunt includes, dotfiles, and ordering.
All three E2E flows passed locally on native ARM64 with Terraform 1.5.0 and the pinned Silo fixture. Anonymous ARM64 and AMD64 image pulls passed. AMD64 runtime and remote CI are not established by those local results.
The changed security workflow passes actionlint.

Checklist

Breaking changes? No
Documentation updated (development, E2E, Lambda, agent guidance, and security policy)
Tests added or updated (make test-all passes)

AI Summary

Scope: security CI, root/Lambda dependencies, E2E fixture, documentation
Type: fix
Key files/areas: go.mod/go.sum, lambda/go.mod, .github/workflows/security.yml, e2e/docker-compose.yaml, internal/stacks/terramate_test.go, SECURITY.md

Summary by CodeRabbit

Security
- Security checks now scan both the main Go module and the Lambda module independently. A failure in one scan does not prevent the other from running.
- Public vulnerability reports are limited to remediation tracking for already-disclosed upstream advisories; new or undisclosed findings must be reported privately.
Documentation
- Added guidance for running vulnerability scans locally and clarified which Go module to use for development.
- Updated security workflow and self-hosting guidance to reflect current behavior and Go version requirements.

Signed-off-by: Eduardo Leal <eduardolleal@icloud.com>

chatgpt-codex-connector · 2026-10-23T15:13:55Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T15:14:55.106467Z	`aa064ea`	PR opened
🔒 Security Review	✅ Completed 2026-10-23T15:16:45.952594Z	`aa064ea`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-23T15:13:55Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 2ebba5a6-6a2e-4bde-9ea8-7a5b7806ec3a

📥 Commits

Reviewing files that changed from the base of the PR and between 939ff11 and aa064ea.

⛔ Files ignored due to path filters: 1

go.sum is excluded by !**/*.sum

📒 Files selected for processing: 12

.claude/skills/testing-and-ci/SKILL.md
.github/workflows/security.yml
AGENTS.md
CLAUDE.md
SECURITY.md
docs/development.md
e2e/README.md
e2e/docker-compose.yaml
go.mod
internal/stacks/terramate_test.go
lambda/README.md
lambda/go.mod

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request updates Go module versions and dependency requirements, configures vulnerability scans for the root and Lambda modules, and revises security guidance. It also changes the E2E object-storage fixture images and adds tests for Terramate changed-stack behavior.

Changes: Go security scans and module updates

Layer / File(s)	Summary
Go versions and dependencies `go.mod`, `lambda/go.mod`, `lambda/README.md`	Both modules now declare Go 1.26.10. The root module’s indirect dependencies change, and the Lambda README directs readers to its `go.mod` for the Go version.
Per-module vulnerability scans `.github/workflows/security.yml`, `docs/development.md`, `.claude/skills/testing-and-ci/SKILL.md`, `AGENTS.md`, `CLAUDE.md`	The workflow runs `govulncheck` separately for the root and Lambda modules, uses each module’s Go configuration, and disables matrix fail-fast. Documentation describes the workflow and local scan commands.
Vulnerability reporting policy `SECURITY.md`	The policy limits public issues to tracking remediation of publicly disclosed upstream dependency advisories. It directs reports of new or undisclosed vulnerabilities to private channels.

E2E object-storage fixture

Layer / File(s)	Summary
Update fixture images and documentation `e2e/docker-compose.yaml`, `e2e/README.md`	Both Compose services now use the digest-pinned `pgsty/silo` image. The README documents the fixture’s image and scope.

Terramate changed-stack tests

Layer / File(s)	Summary
Test changed-stack selection and ordering `internal/stacks/terramate_test.go`	New tests check changed-stack selection, ordering, shared files, Terragrunt sources and includes, dotfiles, and cycle errors using temporary Git repositories.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Gitleaks
  participant GovulncheckRoot
  participant GovulncheckLambda
  GitHubActions->>Gitleaks: Run secret scan
  GitHubActions->>GovulncheckRoot: Scan root module
  GitHubActions->>GovulncheckLambda: Scan lambda module

Possibly related issues

devopsfactory-io/neptune#25 — The pull request updates Go dependencies, security CI, and Docker Compose fixture images, matching the issue’s dependency, security, and Compose maintenance scope.

Merge Risk: ⚪ Minimal · up to aa064

The E2E fixture remains compatible with its initialization command. The outstanding upstream dependency advisories remain visible in the security scan, but no additional merge-blocking regression is established.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (11 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly summarizes the primary changes: reducing security findings through CI updates and restoring end-to-end tests.
Description check		The description completes all required sections, explains the motivation and scope, identifies related issues, documents reviewer considerations, and includes the checklist and AI summary.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (11 skipped: 11 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-23T15:13:57Z

Lambda integration test executed with success...

client_payload:

PR: fix(ci): reduce security findings and restore end-to-end tests #162
Branch: fix/security-dependencies
Command: plan
SHA: aa064ea
Repo: devopsfactory-io/neptune

github-actions · 2026-10-23T15:14:06Z

OpenSSF Scorecard — 7.2/10 ✅

Check	Score	Details
Binary-Artifacts	10/10	no binaries found in the repo
CI-Tests	10/10	29 out of 29 merged PRs checked by a CI test -- score normalized to 10
Code-Review	0/10	Found 1/30 approved changesets -- score normalized to 0
Dangerous-Workflow	10/10	no dangerous workflow patterns detected
License	10/10	license file detected
Pinned-Dependencies	9/10	dependency not pinned by hash detected -- score normalized to 9
Security-Policy	10/10	security policy file detected
Token-Permissions	10/10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	0/10	11 existing vulnerabilities detected

Threshold: 7 | Full report

github-actions · 2026-10-23T15:16:13Z

🌊 Neptune Plan Results

Terraform Stacks: stack-a, stack-b

Neptune completed the plan with status: ✅

For more details, see the GitHub Actions run

Command ✅ terraform init -input=false (stack: stack-a)

Click to see the command output

stderr:


stdout:
[stack-a] Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/null versions matching "~> 3.0"...
- Finding hashicorp/local versions matching "~> 2.0"...
- Installing hashicorp/null v3.3.2...
- Installed hashicorp/null v3.3.2 (signed by HashiCorp)
- Installing hashicorp/local v2.9.1...
- Installed hashicorp/local v2.9.1 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Command ✅ terraform init -input=false (stack: stack-b)

Click to see the command output

stderr:


stdout:
[stack-b] Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/local versions matching "~> 2.0"...
- Finding hashicorp/null versions matching "~> 3.0"...
- Installing hashicorp/null v3.3.2...
- Installed hashicorp/null v3.3.2 (signed by HashiCorp)
- Installing hashicorp/local v2.9.1...
- Installed hashicorp/local v2.9.1 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Command ✅ terraform plan -input=false -out=tfplan (stack: stack-a)

Click to see the command output

stderr:


stdout:
[stack-a] Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.out will be created
  + resource "local_file" "out" {
      + content              = "stack-a output"
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "./out.txt"
      + id                   = (known after apply)
    }

  # null_resource.stack_a will be created
  + resource "null_resource" "stack_a" {
      + id       = (known after apply)
      + triggers = {
          + "stack" = "stack-a"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

Command ✅ terraform plan -input=false -out=tfplan (stack: stack-b)

Click to see the command output

stderr:


stdout:
[stack-b] Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.out will be created
  + resource "local_file" "out" {
      + content              = "stack-b output"
      + content_base64sha256 = (known after apply)
      + content_base64sha512 = (known after apply)
      + content_md5          = (known after apply)
      + content_sha1         = (known after apply)
      + content_sha256       = (known after apply)
      + content_sha512       = (known after apply)
      + directory_permission = "0777"
      + file_permission      = "0777"
      + filename             = "./out.txt"
      + id                   = (known after apply)
    }

  # null_resource.stack_b will be created
  + resource "null_resource" "stack_b" {
      + id       = (known after apply)
      + triggers = {
          + "stack" = "stack-b"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

To apply these changes, comment:

@neptbot apply

github-actions · 2026-10-23T15:16:20Z

🌊 Neptune Apply Results

Terraform Stacks: stack-a, stack-b

Neptune completed the apply with status: ✅

For more details, see the GitHub Actions run

Command ✅ terraform apply -input=false tfplan (stack: stack-a)

Click to see the command output

stderr:


stdout:
[stack-a] null_resource.stack_a: Creating...
null_resource.stack_a: Creation complete after 0s [id=4928253608695948836]
local_file.out: Creating...
local_file.out: Creation complete after 0s [id=a57cdd3e7db0022635e46b54e3ae6357944d9ed4]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Command ✅ terraform apply -input=false tfplan (stack: stack-b)

Click to see the command output

stderr:


stdout:
[stack-b] null_resource.stack_b: Creating...
null_resource.stack_b: Creation complete after 0s [id=4438607099326445438]
local_file.out: Creating...
local_file.out: Creation complete after 0s [id=2d8eff4b1ddeb10a7cfb78093bc91edb5b3318f8]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

fix(ci): reduce security findings and restore end-to-end tests

aa064ea

Signed-off-by: Eduardo Leal <eduardolleal@icloud.com>

eduardoleal requested a review from kaio6fellipe as a code owner October 23, 2026 15:13

github-actions Bot added documentation Improvements or additions to documentation neptune dependencies github-actions GitHub Actions labels Oct 23, 2026

eduardoleal mentioned this pull request Oct 23, 2026

Dependencies: Track unresolved Terramate security findings #163

Open

4 tasks

neptune-ci-tests Bot mentioned this pull request Oct 23, 2026

CI: Neptune PR #162 integration test devopsfactory-io/neptune-tests#313

Closed

eduardoleal mentioned this pull request Oct 23, 2026

fix(ci): use the Go version required by Neptune source devopsfactory-io/neptune-tests#314

Merged

kaio6fellipe approved these changes Oct 23, 2026

View reviewed changes

neptune-ci-tests Bot mentioned this pull request Oct 26, 2026

CI: Neptune PR #162 integration test devopsfactory-io/neptune-tests#315

Closed

eduardoleal merged commit 572c987 into main Oct 27, 2026
27 of 29 checks passed

eduardoleal deleted the fix/security-dependencies branch October 27, 2026 13:07

Navigation Menu

Repository navigation

fix(ci): reduce security findings and restore end-to-end tests - #162

fix(ci): reduce security findings and restore end-to-end tests#162
eduardoleal merged 1 commit into
mainfrom
fix/security-dependencies

eduardoleal commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

eduardoleal commented Oct 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is this feature?

Why do we need this feature?

Who is this feature for?

Related issues

Notes for reviewers

Checklist

AI Summary

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

OpenSSF Scorecard — 7.2/10 ✅

Uh oh!

github-actions Bot commented Oct 23, 2026

🌊 Neptune Plan Results

Uh oh!

github-actions Bot commented Oct 23, 2026

🌊 Neptune Apply Results

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eduardoleal commented Oct 23, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading