Repository navigation
Conversation
|
Cross-session merge coordination: the user now explicitly authorized consolidating and merging these portfolio improvements once their required checks and workflows are verified. The current head still has failing backend lint, frontend date assertions, and the preserved 95% coverage gate (reported actual coverage 22.84% lines/statements). Security/E2E jobs also remain blocked. Please complete those checks rather than lower thresholds; consolidate the service-settings change with #1 and test the actual review workflow. I am handling eval_mvp and DRL4MM merges only; I have not changed this owner's branch. Please acknowledge ownership and reply with the final head SHA, passing commands/CI, remaining blockers, and intended merge order. The central coordination thread is jadenfix/ecosystem#3. Do not release GIF/video captures from a superseded revision or claim an unverified live integration. |
…nd review workflow
…ble calendar dates
jadenfix
changed the title
|
Coverage follow-up on canonical head b8cf42f: the inherited 95% exception gate is now legitimately passing. Added behavior regressions for loading/error/empty queue states, authenticated failure handling, completed/unreviewable invoices, approve/reject validation and cancellation, server audit identity and query-cache transitions, failed writes, source PDF download/authentication/URL cleanup, malformed dates, pagination, filters, and keyboard/pointer sorting. No threshold, collection scope, exclusion, or runtime control was weakened. 80 exception module tests /82 full frontend tests pass; coverage100% statements/lines,98.26% branches,98.68% functions. Lint, formatting, typecheck and ordinary build pass. The real-pipeline job now also enforces the unchanged coverage gate before browser acceptance. Original intended frontend CI gate is fully green: https://github.com/jadenfix/InvoiceFlowAgent/actions/runs/38334064598/job/115090083473. Exact-head durable pipeline https://github.com/jadenfix/InvoiceFlowAgent/actions/runs/38334060822/job/115090072265 has already passed actual HTTP/Postgres/RabbitMQ/PDF proof plus all frontend checks; browser receipt pending at posting time. Separate legacy backend flake8 and Security Scan job-setup failures remain in the broader exception-service workflow. Those do not invalidate the earned frontend coverage receipt, but that whole workflow must not be described as green. |
|
Final exact-head receipt for b8cf42f: durable real pipeline job fully GREEN https://github.com/jadenfix/InvoiceFlowAgent/actions/runs/38334060822/job/115090072265. It passed real PostgreSQL/RabbitMQ/PDF HTTP/outage/restart proof, 9 backend tests, 82 frontend tests, unchanged 95% exception coverage gate, lint/format/typecheck/build, and default REAL_PIPELINE Chromium acceptance at1440/390 (signup, invalid-password rejection, login, upload, authenticated source PDF download, approval, reload, queue removal, logout/protected route). The verified local text-PDF plus authenticated review scope is ready to record at this SHA. Python readiness owner is taking only the separate legacy backend flake8 /Security Scan setup fixes; refresh this receipt after any subsequent canonical-head change. |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
…eline in original E2E gate
… and source gates
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Trivy found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
|
Security handoff at7c6576f82f085bfbed3b04f2d63f87942b57d4a3: actual57Trivy annotations on the integrated main branch grouped into pypdf49, python-multipart7 and pytest1 findings. Their patch versions are now pypdf6.19.0, python-multipart0.0.31 and pytest9.0.3. Full Python3.11 pipeline requirements resolve; real9parser/matching tests pass on fresh published source with these dependencies. StrictTrivy check115110431656 succeeds with no new alerts. Actual durable Docker/Postgres/RabbitMQ outage/restart/browser pipeline gate remains separately running with services owner; no security suppression or test removal. Match testcontainers now declares supported PostgreSQL/RabbitMQ extras, addressing a real missing queue test adapter. |
|
Coordinated Auth dependency handoff at ccc7014: after source owner published and tested direct bcrypt5 password handling (51Auth tests, compatible existing hashes, strict72UTF8-byte boundaries), Auth requirements now declare bcrypt>=5,<6 instead of the obsolete adapter, EmailStr validator2.3.0 and pytest-cov7.0.0. Full Python3.11 resolver succeeds. StrictTrivy115111315962 succeeds with no new alerts. Pipeline9-test and Docker/Postgres/RabbitMQ/browser results and ordinaryAuth/MatchCI remain distinct source-owner gates; no source/security checks disabled. |
…og-sink exceptions
| #tfsec:ignore:aws-s3-enable-bucket-logging | ||
| resource "aws_s3_bucket" "access_log_sink" { | ||
| bucket = "${var.project_name}-${var.environment}-access-logs-${data.aws_caller_identity.current.account_id}" | ||
| tags = var.tags |
| #tfsec:ignore:aws-s3-enable-bucket-logging | ||
| resource "aws_s3_bucket" "access_log_sink" { | ||
| bucket = "${var.project_name}-${var.environment}-access-logs-${data.aws_caller_identity.current.account_id}" | ||
| tags = var.tags |
| #tfsec:ignore:aws-s3-enable-bucket-logging | ||
| resource "aws_s3_bucket" "access_log_sink" { | ||
| bucket = "${var.project_name}-${var.environment}-access-logs-${data.aws_caller_identity.current.account_id}" | ||
| tags = var.tags |
| } | ||
| resource "aws_s3_bucket_lifecycle_configuration" "access_log_sink" { | ||
| bucket = aws_s3_bucket.access_log_sink.id | ||
| rule { | ||
| id = "access-log-retention" | ||
| status = "Enabled" | ||
| expiration { days = 365 } | ||
| noncurrent_version_expiration { noncurrent_days = 365 } | ||
| } |
…als and regional recovery source
| resource "aws_autoscaling_attachment" "application" { | ||
| #checkov:skip=CKV2_AWS_15:EKS-managed ASG uses node health; ALB HTTPS target health is configured separately. | ||
| for_each = module.eks.node_autoscaling_groups | ||
| autoscaling_group_name = each.value | ||
| lb_target_group_arn = aws_lb_target_group.application.arn | ||
| } |
| resource "aws_autoscaling_attachment" "application" { | ||
| #checkov:skip=CKV2_AWS_15:EKS-managed ASG uses node health; ALB HTTPS target health is configured separately. | ||
| for_each = module.eks.node_autoscaling_groups | ||
| autoscaling_group_name = each.value | ||
| lb_target_group_arn = aws_lb_target_group.application.arn | ||
| } |
| resource "aws_autoscaling_attachment" "application" { | ||
| #checkov:skip=CKV2_AWS_15:EKS-managed ASG uses node health; ALB HTTPS target health is configured separately. | ||
| for_each = module.eks.node_autoscaling_groups | ||
| autoscaling_group_name = each.value | ||
| lb_target_group_arn = aws_lb_target_group.application.arn | ||
| } |
| #tfsec:ignore:aws-s3-enable-bucket-logging | ||
| resource "aws_s3_bucket" "access_log_sink" { | ||
| #checkov:skip=CKV_AWS_145:AWS S3 and ALB access-log destinations require SSE-S3; source buckets remain KMS encrypted. | ||
| bucket = "${var.project_name}-${var.environment}-access-logs-${data.aws_caller_identity.current.account_id}" | ||
| tags = var.tags |
| resource "aws_s3_bucket" "replica" { | ||
| #checkov:skip=CKV_AWS_144:Terminal one-way recovery replicas receive CRR; outbound re-replication is outside this recovery architecture. | ||
| provider = aws.dr | ||
| for_each = local.kms_names | ||
| bucket = local.replica_names[each.key] | ||
| tags = merge(var.tags, { RecoveryRole = "terminal-replica", SourceBucket = var.source_buckets[each.key].id }) | ||
| lifecycle { | ||
| precondition { | ||
| condition = data.aws_region.primary.name != data.aws_region.dr.name | ||
| error_message = "Recovery provider must be in a different AWS region." | ||
| } | ||
| precondition { | ||
| condition = data.aws_caller_identity.primary.account_id == data.aws_caller_identity.dr.account_id | ||
| error_message = "This module supports same-account replication only." | ||
| } | ||
| } | ||
| } |
| resource "aws_s3_bucket" "log_replica" { | ||
| #checkov:skip=CKV_AWS_144:Terminal recovery copy of source access logs; no reverse or third-region replication. | ||
| #checkov:skip=CKV_AWS_145:AWS replication preserves required SSE-S3 access-log encryption; CMK encryption is not claimed for these replicas. | ||
| provider = aws.dr | ||
| bucket = local.replica_names["access_logs"] | ||
| tags = merge(var.tags, { RecoveryRole = "terminal-access-log-replica", SourceBucket = var.source_buckets["access_logs"].id }) | ||
| lifecycle { | ||
| precondition { | ||
| condition = data.aws_region.primary.name != data.aws_region.dr.name && data.aws_caller_identity.primary.account_id == data.aws_caller_identity.dr.account_id | ||
| error_message = "Recovery must use another region in the same AWS account." | ||
| } | ||
| } | ||
| } |
| resource "aws_s3_bucket" "log_replica" { | ||
| #checkov:skip=CKV_AWS_144:Terminal recovery copy of source access logs; no reverse or third-region replication. | ||
| #checkov:skip=CKV_AWS_145:AWS replication preserves required SSE-S3 access-log encryption; CMK encryption is not claimed for these replicas. | ||
| provider = aws.dr | ||
| bucket = local.replica_names["access_logs"] | ||
| tags = merge(var.tags, { RecoveryRole = "terminal-access-log-replica", SourceBucket = var.source_buckets["access_logs"].id }) | ||
| lifecycle { | ||
| precondition { | ||
| condition = data.aws_region.primary.name != data.aws_region.dr.name && data.aws_caller_identity.primary.account_id == data.aws_caller_identity.dr.account_id | ||
| error_message = "Recovery must use another region in the same AWS account." | ||
| } | ||
| } | ||
| } |
| resource "aws_s3_bucket" "access_log_sink" { | ||
| #checkov:skip=CKV_AWS_18:Terminal DR access-log sink must not log to itself; audit reads with the existing multi-region CloudTrail. | ||
| #checkov:skip=CKV_AWS_145:AWS S3 server-access logging requires SSE-S3 on its destination, not SSE-KMS. | ||
| #checkov:skip=CKV_AWS_144:Terminal DR log-delivery sink; another outbound DR region is not part of this one-way recovery architecture. | ||
| provider = aws.dr | ||
| bucket = local.access_log_name | ||
| tags = merge(var.tags, { RecoveryRole = "terminal-access-delivery" }) | ||
| } |
| resource "aws_s3_bucket" "access_log_sink" { | ||
| #checkov:skip=CKV_AWS_18:Terminal DR access-log sink must not log to itself; audit reads with the existing multi-region CloudTrail. | ||
| #checkov:skip=CKV_AWS_145:AWS S3 server-access logging requires SSE-S3 on its destination, not SSE-KMS. | ||
| #checkov:skip=CKV_AWS_144:Terminal DR log-delivery sink; another outbound DR region is not part of this one-way recovery architecture. | ||
| provider = aws.dr | ||
| bucket = local.access_log_name | ||
| tags = merge(var.tags, { RecoveryRole = "terminal-access-delivery" }) | ||
| } |
| resource "aws_s3_bucket" "access_log_sink" { | ||
| #checkov:skip=CKV_AWS_18:Terminal DR access-log sink must not log to itself; audit reads with the existing multi-region CloudTrail. | ||
| #checkov:skip=CKV_AWS_145:AWS S3 server-access logging requires SSE-S3 on its destination, not SSE-KMS. | ||
| #checkov:skip=CKV_AWS_144:Terminal DR log-delivery sink; another outbound DR region is not part of this one-way recovery architecture. | ||
| provider = aws.dr | ||
| bucket = local.access_log_name | ||
| tags = merge(var.tags, { RecoveryRole = "terminal-access-delivery" }) | ||
| } |
|
Infrastructure source proof at exact head The exact Checkov exception inventory is: This is a qualified source-validation receipt, not an AWS deployment or restore receipt. Readiness job explicitly reports AWS plan NOT_EXECUTED without a configured actual AWS role; all apply jobs were skipped and their existing conditions were preserved. Real account/state/AZ/CIDR/certificate/NodePort/DR inputs and a deployed TLS application gateway are still prerequisites. No cloud resources or costs were created by this repair. The independently tested local PostgreSQL/RabbitMQ/PDF/browser workflow remains the recording scope. |
… S3 and confirmed terminal events
… before confirmed broker retry
jadenfix
changed the title
2 participants
The local product now processes actual embedded-text PDFs through PostgreSQL, durable RabbitMQ outbox stages, matching and authenticated browser review. The old ingest/extract CLIs are thin adapters to this authoritative runtime, with actual persisted status/readiness and explicit rejection of unsupported OCR/AI modes. Strict amount parsing rejects malformed or contradictory total labels.
Local S3 is an explicit emulator mirror: source write/read byte verification, separate extracted JSON bucket, fail-closed local-only endpoint/credential configuration and actual readiness. Matching is not marked COMPLETED until the terminal broker publication is confirmed; a rejected publication preserves MATCHED/unsent state for retry.
Validated exact head 4edf894:76 parser/adapter/storage contracts; actual shared LocalStack/PostgreSQL/RabbitMQ Docker workflow requiring PDF-derived995/PO auto-approval and2500/noPO review despite contradictory metadata, exactS3bytes/JSON, persistedrows, correlatedterminalevents, malformedPDF failure, realmissingbucket503/noinvoice and transactionalpublication rejection→actualconfirmedretry; realPostgreSQL/RabbitMQHTTP outages/restart/replay; actual1440/390 browser signup/login/upload/review/sourcePDF/reload/logout;82frontend tests and unchanged95%exception coverage;27exceptionunit97.46%unchanged95 plus16realproviderintegration tests/migrations;51nativeAuth tests andrealPG/HTTP;17nativeMatch tests withrealPG/MQ; strictsecurity andTerraformsource/hardscans.
Provider proof: https://github.com/jadenfix/InvoiceFlowAgent/actions/runs/38346404430/job/115129363745 ; actual browser/pipeline: https://github.com/jadenfix/InvoiceFlowAgent/actions/runs/38346404234/job/115128743086 .
Migration and exact supported contracts: docs/LOCAL_PIPELINE_MIGRATION.md. Prototype tables are not silently imported or deleted. Native Auth JWT and local pipeline opaque sessions remain separate issuers. Live OCR/Textract/LLM, real AWS S3/ERP, public tenancy and cloud deployment are not claimed; no live provider calls, image pushes or applies performed. Original deployment jobs remain credential/event gated.