7d:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:T98b,## Stack (DEP-91) Split from #1662 for reviewability, then **rescoped**: `main` has since landed #1681 (dependency/toolchain CVEs) and #1693 (`hoophq/hoopagent`), which superseded two PRs of the original stack. - ~~#1683 — Go dependency + toolchain CVE bumps~~ — closed, superseded by #1681 - ~~#1685 — opt-in `hoophq/hoopdev-minimal`~~ — closed, superseded by #1693 - #1684 — 1. agent-tools: drop kernel-header CVEs, modernize clean train - #1686 — 2. Vulnerability gates for hoopagent + govulncheck **← you are here** - #1687 — 3. SBOM + bundled-tool manifest on releases - #1688 — 4. Weekly base-OS rebuild of hoopagent - #1689 — 5. Image release integrity hardening Merge in order, bottom-up. Each PR targets the one below it. The remaining work is what `main` still lacks: the fat image's kernel-header CVEs, and any vulnerability gate, SBOM, or scheduled OS patching for `hoophq/hoopagent`. --- ## What Adds the vulnerability gating `hoophq/hoopagent` currently has none of: - **Build smoke check** for `Dockerfile.agent`, both flavours, both platforms. It was previously only built after a tag push, so a broken Dockerfile could reach `main` and fail post-merge. - **Enforcing Trivy gate** on fixable CRITICAL/HIGH for both flavours. - **Unprivileged-user assertion** — resolves `USER` to a real uid, handling `distroless` (`10001:10001`, numeric) and `minimal` (`hoop`, by name) correctly. - **Report-only Trivy** on `agent-tools`, which bundles upstream CLIs whose CVEs cannot be rebuilt away. - **govulncheck** (pinned v1.6.0) on every PR for the shipped Go binary. ## Why `hoophq/hoopagent` is the low-CVE image, but nothing enforced that. `main` runs Trivy with `--scanners license` only — there is no vulnerability gate anywhere, and no source-level Go gate. ## Risk Adds blocking checks. The fat image stays report-only, so existing releases are not newly gated. ## Note on the placeholder binary The release tarballs do not exist at PR time, so the smoke build stages placeholder tars named `hoop_*_Linux_${TARGETARCH}.tar.gz` — matching `Dockerfile.agent`'s glob, which uses GOARCH values, not `uname -m`. This gates Dockerfile correctness and the base layer, not a functional agent. ## How to test Open any PR touching `Dockerfile.agent`: **Build Slim Agent Image** runs for both flavours and must pass. **Go Vulnerability Gate** runs on every PR. Part of DEP-91. Automated by MisterMal79:T15a2,

PR Summary by Qodo

DEP\-91: add Trivy gates for minimal image and govulncheck PR gate ✨ Enhancement ⚙️ Configuration changes 🕐 40\+ Minutes Grey Divider

AI Description

> • Add enforcing Trivy scan to block fixable HIGH/CRITICAL CVEs on minimal image PR builds.
> • Add govulncheck job gating reachable Go vulnerabilities for the shipped hoop binary.
> • Add non-blocking Trivy reporting for agent-tools images to track fixable CVE trends.
>

Diagram

```mermaid graph TD A["PR / commit"] --> B["GitHub Actions"] --> C(["Go Vulnerability Gate"]) --> D["Go source (client)"] B --> E(["Build hoopdev-minimal"]) --> F(["Trivy gate (HIGH/CRITICAL)"]) --> G["Dockerfile.minimal"] B --> H(["Trivy report-only (agent-tools)"]) ```

High-Level Assessment

> The following are alternative approaches to this PR:

1. Use official GitHub Actions for scanners

- ➕ Avoids Docker\-in\-Docker socket mounting for Trivy runs - ➕ Built\-in features for caching and standardized outputs - ➕ Easier future SARIF/code\-scanning integration - ➖ May reduce transparency versus explicit CLI flags in the workflow - ➖ Action upgrades can introduce behavior changes unless pinned carefully

2. Publish SARIF/Artifacts instead of only Step Summary

- ➕ Enables trend tracking and triage in GitHub Security/Code Scanning UI - ➕ Preserves full scan output for auditing and debugging - ➖ More CI configuration and retention management - ➖ May add noise unless tuned (especially for report\-only agent\-tools)

> **Recommendation:** Current approach is sound for DEP\-91’s goals: it pins tool versions for deterministic gating (govulncheck v1.6.0, trivy image scanning) and intentionally keeps agent\-tools non\-blocking to avoid ignore\-list sprawl. Consider a follow\-up to emit SARIF/artifacts and/or move to pinned official actions if reducing docker\-sock exposure becomes a priority.

Files changed (4) +110 / -1

Other (4) +110 / -1

agent-tools-build.ymlAdd report-only Trivy scan summary for agent-tools images (amd64/arm64) +44/-0

> Add report\-only Trivy scan summary for agent\-tools images (amd64/arm64) > >

> • Runs Trivy against built agent-tools images in both architecture jobs, capturing fixable HIGH/CRITICAL counts. Writes a short top-packages summary to the GitHub step summary without failing the workflow (explicitly report-only).
>

> > .github/workflows/agent\-tools\-build.yml

minimal-image-build.ymlEnforce Trivy HIGH/CRITICAL gate on minimal PR-smoke image +15/-0

> Enforce Trivy HIGH/CRITICAL gate on minimal PR\-smoke image > >

> • Adds a blocking Trivy scan step for the minimal PR-smoke image, failing the job if any fixable HIGH/CRITICAL vulnerabilities are present. Documents that the scan is intended to enforce the OS/base layer for the minimal image.
>

> > .github/workflows/minimal\-image\-build.yml

pullrequest.ymlAdd govulncheck job to gate reachable Go vulnerabilities on PRs +42/-1

> Add govulncheck job to gate reachable Go vulnerabilities on PRs > >

> • Introduces a new PR job that checks out both hoop and libhoop, installs a pinned govulncheck version, and runs it against the shipped client module. This makes reachable Go dependency/toolchain vulnerabilities a merge blocker.
>

> > .github/workflows/pullrequest.yml

Dockerfile.minimalApply security upgrades during minimal image build via apt-get upgrade +9/-0

> Apply security upgrades during minimal image build via apt\-get upgrade > >

> • Adds an apt-get upgrade step before package installation to pull current upstream security patches. Explicitly documents the reproducibility trade-off (non-bit-identical rebuilds over time) as intentional for a low-CVE base image.
>

> > Dockerfile.minimal

7a:T3d79,

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🔗 Cross\-repo conflicts (2) 📜 Skill insights (0) Grey Divider

1. Trivy report can still fail 🐞 Bug ☼ Reliability

Description

>
> >

> In agent-tools-build.yml, the new “non-blocking” Trivy report step ignores Trivy failures ("||
> true") but then runs an unguarded jq ... | head pipeline; if Trivy produces empty/invalid JSON,
> jq can fail and block the workflow anyway. This can prevent later steps (including publish) from
> running even though the step is intended to be report-only.
>

> >

Code

>
> >

[.github/workflows/agent\-tools\-build.yml[R197\-200]](https://github.com/hoophq/hoop/pull/1686/files#diff-dd9fb7f5b7c026b31ce1404547a4ca72a19c5d68ee60bbd889fe6d29033d7f82R197-R200)

> > ```diff > + echo "Strict gate is on hoophq/hoopdev-minimal. Top packages:" > + echo '```' > + jq -r '[.Results[]?.Vulnerabilities // []]|add|group_by(.PkgName)|map({p:.[0].PkgName,c:length})|sort_by(-.c)|.[]|"\(.c)\t\(.p)"' trivy-vuln.json 2>/dev/null | head -20 > + echo '```' > ``` >

Relevance

>
> > `●●● Strong` > >

> Non-blocking step should never fail; guarding jq/head is small deterministic workflow-hardening.
>

> > [PR\-\#1595](https://github.com/hoophq/hoop/pull/1595) > [PR\-\#1619](https://github.com/hoophq/hoop/pull/1619) > > ⓘ Recommendations generated based on similar findings in past PRs >

Evidence

>
> >

> The step intentionally ignores Trivy failures when writing trivy-vuln.json, but then immediately
> runs a jq pipeline (without any fallback) to render the "Top packages" list; this can still fail
> if the JSON file is empty/invalid. The same pattern is duplicated in the arm64 job.
>

> >

[.github/workflows/agent\-tools\-build.yml[179\-201]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/agent-tools-build.yml/#L179-L201)

[.github/workflows/agent\-tools\-build.yml[300\-318]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/agent-tools-build.yml/#L300-L318)

Agent prompt

>
> > ``` > The issue below was found during a code review. Follow the provided context and guidance below and implement a solution > > ## Issue description > The Trivy step is explicitly labeled/report-only and uses `|| true` to avoid failing when Trivy errors, but the subsequent `jq ... | head` command is not guarded. If `trivy-vuln.json` is empty or invalid (e.g., Trivy fails before producing valid JSON), `jq` may exit non-zero and the step can still fail. > > ## Issue Context > This occurs in both amd64 and arm64 jobs in `agent-tools-build.yml`. > > ## Fix Focus Areas > - .github/workflows/agent-tools-build.yml[185-201] > - .github/workflows/agent-tools-build.yml[302-318] > > ## Suggested fix approach > - Make the "Top packages" rendering resilient, e.g.: > - Wrap it in a conditional JSON validity check (`jq -e . trivy-vuln.json >/dev/null 2>&1`) and print a fallback message when invalid; and/or > - Append `|| true` to the `jq ... | head` pipeline. > - Also consider making the count query robust to empty `.Results` by using `add // []` (or similar) so it produces `0` instead of `null` when appropriate. > ``` > ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools >

2. Gate needs libhoop token 🔗 Cross-repo conflict ☼ Reliability

Description

>
> >

> The new blocking govulncheck job requires checking out hoophq/libhoop using secrets.GH_TOKEN; if
> that secret is not available in a given PR context, the checkout/build will fail and block merges.
> This adds/strengthens a cross-repo access contract between this repo’s PR CI and the libhoop repo’s
> availability/permissions.
>

> >

Code

>
> >

[.github/workflows/pullrequest.yml[R328\-331]](https://github.com/hoophq/hoop/pull/1686/files#diff-ce9a2f9036cc2a5aaf1f78839c4f65c7a12808822e0dd0f3552471921ac5e007R328-R331)

> > ```diff > + repository: hoophq/libhoop > + path: "./libhoop" > + token: ${{ secrets.GH_TOKEN }} > + ref: ${{ needs.resolve-libhoop.outputs.sha }} > ``` >

Relevance

>
> > `●●● Strong` > >

> They’ve accepted adding explicit checks around required secrets to avoid late workflow failures.
>

> > [PR\-\#1595](https://github.com/hoophq/hoop/pull/1595) > > ⓘ Recommendations generated based on similar findings in past PRs >

Evidence

>
> >

> The newly-added govulncheck job checks out hoophq/libhoop using secrets.GH_TOKEN, and the
> workspace includes ./libhoop, meaning the job’s success depends on successfully fetching that
> separate repository/module. This is an explicit cross-repo auth/availability dependency introduced
> into the PR merge gate.
>

> >

[.github/workflows/pullrequest.yml[3\-4]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/pullrequest.yml/#L3-L4)

[.github/workflows/pullrequest.yml[27\-41]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/pullrequest.yml/#L27-L41)

[.github/workflows/pullrequest.yml[309\-331]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/pullrequest.yml/#L309-L331)

> [go.work[1\-16]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/go.work/#L1-L16) >

[External repo: hoophq/libhoop, go.mod [1\-4]](https://github.com/hoophq/libhoop/blob/84d16e41d55b3c38489c2349f65de7377c6c95c4/go.mod/#L1-L4)

Agent prompt

>
> > ``` > The issue below was found during a code review. Follow the provided context and guidance below and implement a solution > > ### Issue description > `govulncheck` is now a blocking PR job and it checks out `hoophq/libhoop` using `secrets.GH_TOKEN`. If `GH_TOKEN` is missing/unavailable for a PR run (common in fork PR scenarios), the gate will fail before analysis. > > ### Issue Context > The workflow uses `on: pull_request`, and both `resolve-libhoop` and `govulncheck` rely on `secrets.GH_TOKEN` to access libhoop. > > ### Fix Focus Areas > - .github/workflows/pullrequest.yml[3-4] > - .github/workflows/pullrequest.yml[27-41] > - .github/workflows/pullrequest.yml[309-331] > - go.work[1-16] > > ### Suggested change > Implement one of the following patterns: > 1) **Conditional gate**: only run `govulncheck` (or only the libhoop checkout step) when `secrets.GH_TOKEN` is present, and otherwise skip the job with a clear message. > 2) **OSS stub fallback**: when libhoop checkout cannot run, create `./libhoop` by symlinking to `./_libhoop` (or running the existing mapping target) so govulncheck can still compile against the OSS stub. > 3) If `hoophq/libhoop` is intended to be publicly readable for CI, remove the hard dependency on `secrets.GH_TOKEN` for checkout and use a standard token/unauthenticated checkout. > ``` > ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools >

3. Gate tracks libhoop head 🔗 Cross-repo conflict ☼ Reliability

Description

>
> >

> The new blocking govulncheck job compiles against the libhoop revision resolved at workflow runtime
> (default-branch HEAD when no paired branch), so re-running the same Hoop PR commit can start failing
> due to new changes/vulns in hoophq/libhoop. This increases cross-repo coupling and reduces CI
> reproducibility across reruns.
>

> >

Code

>
> >

[.github/workflows/pullrequest.yml[R328\-331]](https://github.com/hoophq/hoop/pull/1686/files#diff-ce9a2f9036cc2a5aaf1f78839c4f65c7a12808822e0dd0f3552471921ac5e007R328-R331)

> > ```diff > + repository: hoophq/libhoop > + path: "./libhoop" > + token: ${{ secrets.GH_TOKEN }} > + ref: ${{ needs.resolve-libhoop.outputs.sha }} > ``` >

Relevance

>
> > `●● Moderate` > >

> Reproducibility vs tracking latest libhoop is a policy trade-off; no close pinning precedent found.
>

> > ⓘ Recommendations generated based on similar findings in past PRs >

Evidence

>
> >

> The PR workflow’s resolve-libhoop job explicitly falls back to the current default-branch
> checkout’s HEAD when there is no paired branch, and the newly-added govulncheck job checks out
> libhoop at that resolved SHA. The workspace expects a local ./libhoop module, and libhoop is an
> independent Go module in a separate repository, so its moving default-branch state can change the
> dependency graph analyzed by govulncheck across reruns.
>

> >

[.github/workflows/pullrequest.yml[27\-77]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/pullrequest.yml/#L27-L77)

[.github/workflows/pullrequest.yml[309\-348]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/.github/workflows/pullrequest.yml/#L309-L348)

> [go.work[1\-16]](https://github.com/hoophq/hoop/blob/2c4d9b527dcf6af5bbce15d5112bb268fe5234e4/go.work/#L1-L16) >

[External repo: hoophq/libhoop, go.mod [1\-4]](https://github.com/hoophq/libhoop/blob/84d16e41d55b3c38489c2349f65de7377c6c95c4/go.mod/#L1-L4)

Agent prompt

>
> > ``` > The issue below was found during a code review. Follow the provided context and guidance below and implement a solution > > ### Issue description > The new `govulncheck` merge gate checks out and compiles against `hoophq/libhoop` using a SHA that can resolve to the libhoop default branch HEAD when no paired branch exists. This makes Hoop PR results dependent on a moving external repo state and can cause the same PR commit to pass/fail depending on when the workflow is run. > > ### Issue Context > - `resolve-libhoop` falls back to the default-branch checkout’s current `HEAD` when a same-named paired branch does not exist. > - `govulncheck` then checks out that resolved SHA and compiles the workspace (which includes `./libhoop`). > > ### Fix Focus Areas > - .github/workflows/pullrequest.yml[27-77] > - .github/workflows/pullrequest.yml[309-348] > - go.work[1-16] > > ### Suggested change > - Introduce an immutable, Hoop-repo-controlled fallback libhoop revision for the “no paired branch” case (e.g., a committed `LIBHOOP_SHA` file or workflow variable), and have `resolve-libhoop` use that pinned SHA instead of “whatever HEAD is today”. > - Keep the paired-branch behavior as-is for coordinated cross-repo changes. > ``` > ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools >

Context

✅ Tickets:

🎫 [Feature]: hoophq/hoopdev base image carries 1,000+ fixable CVEs; request slimmer agent image and dependency refresh

✅ Compliance rules (platform): 39 rules

✅ Cross-repo context

Explored: repo: hoophq/libhoop (sha: 84d16e41)

Not relevant to this PR: hoophq/infra

Not relevant to this PR: hoophq/documentation

Not relevant to this PR: hoophq/changelog

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ \| Customize Qodo ↗ \| Qodo docs ↗

7b:T5ae, ## 📋 API Changelog # API Changelog unknown vs. unknown ## API Changes ### GET /access-requests/rules - :warning: added the new `jit_command` enum value to the `data/items/access_type` response property for the response status `200` - added the optional property `data/items/skip_review_groups` to the response with the `200` status ### POST /access-requests/rules - :warning: added the new `jit_command` enum value to the `access_type` response property for the response status `201` - added the new optional request property `skip_review_groups` - added the new `jit_command` enum value to the request property `access_type` - added the optional property `skip_review_groups` to the response with the `201` status ### GET /access-requests/rules/{name} - :warning: added the new `jit_command` enum value to the `access_type` response property for the response status `200` - added the optional property `skip_review_groups` to the response with the `200` status ### PUT /access-requests/rules/{name} - :warning: added the new `jit_command` enum value to the `access_type` response property for the response status `200` - added the new optional request property `skip_review_groups` - added the new `jit_command` enum value to the request property `access_type` - added the optional property `skip_review_groups` to the response with the `200` status ### GET /connection-credentials - endpoint added62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"hoophq","repo":"hoop","pullNumber":1686}],"data":{"repositoryId":"4079","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/33ea12519871e768926d5967b52b2a4a?key=AarGO97nEU22hrL28WYzC3YZ7Sutnv4nOzyP1Hs7043LEgaDRiCMob5DL%2FdswzqML5uI54vi1cOiTiDZWHwYYL%2Bb2DfE7PmIAZzrBABp4LTeU4B2ofeOFrQAWOe6dQUa7jTJgBekAZyQnshVHmT3VTzxsjDhRKGx4pEZvL0T4kj64mnFyYJ5ho0%3D","externalProvider":"github","login":"racerxdl","type":"User","url":"https://github.com/racerxdl"},"authorId":"578310","baseRefName":"dep-91-tools","closedAt":null,"comments":8,"createdAt":"2026-08-06T21:08:11Z","headRefName":"dep-91-gates","id":"4873911","isDraft":false,"labels":[{"color":"c5def5","description":"Merges without publishing a release (docs, CI, refactors, etc.)","name":"skip-release"}],"number":1686,"repository":{"name":"hoop","owner":"hoophq","provider":"forgejo"},"state":"open","title":"DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck","updatedAt":"2026-08-12T17:54:26Z","url":"https://trylle.com/hoophq/hoop/pulls/1686","body":"$78","additions":221,"deletions":10,"changedFiles":3,"commits":2,"reviewComments":3,"headSha":"2c4d9b527dcf6af5bbce15d5112bb268fe5234e4","baseSha":"0473ea463cbc3d468157efdc0722975703e1b480","headRepoOwner":"hoophq","headRepoName":"hoop","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:1686"},"comments":[{"id":26265322,"graphqlId":"26265322","body":"$79","createdAt":"2026-08-06T21:19:20Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26265324,"graphqlId":"26265324","body":"$7a","createdAt":"2026-08-06T21:23:04Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26265387,"graphqlId":"26265387","body":"\n## Migration Safety Analysis\n\nNo database migrations were changed in this PR. Safe to deploy to sandbox.","createdAt":"2026-08-10T14:20:30Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26265388,"graphqlId":"26265388","body":"$7b","createdAt":"2026-08-10T14:21:21Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26265392,"graphqlId":"26265392","body":"✅ Build Completed with Success, Version=1686.0.0-g27d00d4","createdAt":"2026-08-10T14:49:56Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/470961e494def4cd0709b7c42504cc37?key=AeihVuRUBQXr2SP8xQfP4NAuhIa8YVJqZHLiHn8Nfc9Yeq0RQL05J2GOEmvFOyDPKt4%2FP2zVT0RfAp2CLtRaQPGD8ntWMqnIDeNc3ZldOwQ%2BZOKRfk%2Fem0j1BHXuJvu%2B1nhG%2B8S5n5iqKaAv0QXZWT%2B%2FtcI1o%2FT0edI4%2FQIQaFbnUZo3RjL9OPU%3D","externalProvider":"github","login":"sandromello","type":"User","url":"https://github.com/sandromello"}}],"commits":[{"sha":"2c4d9b527dcf6af5bbce15d5112bb268fe5234e4","message":"ci: fix slim-agent smoke fixture and gate both arches\n\nThe placeholder archive stored its member as `hoop` while\nDockerfile.agent extracts `./hoop`, so both required checks failed at\nthe build step and never reached the user assertion or the CVE gate.\nStage the fixture the way `make build-tar-files` does (`-C stage .`) and\nassert the member exists before building.\n\nThe gates also only ever ran against amd64: the multiarch build cannot\nbe loaded, and the loaded rebuild was amd64-only. Make the architecture\na matrix dimension so the runtime-user assertion and the enforcing Trivy\nscan cover both released platforms. Also run on Makefile changes, since\nthat is what defines the archive layout the fixture imitates.\n\n 🤖 Generated with Mister Maluco\n\nCo-Authored-By: MisterMal \n","createdAt":"2026-08-10T15:17:28-03:00","author":{"avatarUrl":"","login":"","name":"Lucas Teske","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}},{"sha":"ec7295955433f40e9e7bc5111899bbefe17eb600","message":"ci: gate hoopagent vulnerabilities and add govulncheck\n\nPart of DEP-91. Gate container and Go vulnerabilities in CI:\n\n- hoophq/hoopagent (both flavours): enforcing Trivy CRITICAL/HIGH gate\n (--ignore-unfixed) plus a build smoke check and unprivileged-user assertion.\n Dockerfile.agent was previously only built after a tag push.\n- agent-tools (both trains): report-only Trivy scan. The fat image bundles\n upstream CLIs whose CVEs cannot be rebuilt away, so it is monitored, not\n enforced (avoids suppression sprawl).\n- govulncheck (pinned v1.6.0): source-level gate on every PR for the shipped\n hoop binary, catching reachable Go dep/toolchain CVEs an image scan misses.\n\nFixes #DEP-91\n\n 🤖 Generated with Mister Maluco\n\nCo-Authored-By: MisterMal \n","createdAt":"2026-08-10T11:07:37-03:00","author":{"avatarUrl":"","login":"","name":"Lucas Teske","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}}],"events":[{"id":26258941,"event":"reviewed","createdAt":"2026-08-06T21:23:05Z","actor":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"reviewId":3430422,"reviewState":"COMMENT"}],"reviews":[{"id":3430423,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/470961e494def4cd0709b7c42504cc37?key=AeihVuRUBQXr2SP8xQfP4NAuhIa8YVJqZHLiHn8Nfc9Yeq0RQL05J2GOEmvFOyDPKt4%2FP2zVT0RfAp2CLtRaQPGD8ntWMqnIDeNc3ZldOwQ%2BZOKRfk%2Fem0j1BHXuJvu%2B1nhG%2B8S5n5iqKaAv0QXZWT%2B%2FtcI1o%2FT0edI4%2FQIQaFbnUZo3RjL9OPU%3D","externalProvider":"github","login":"sandromello","type":"User","url":"https://github.com/sandromello"},"submittedAt":"2026-08-06T21:08:11Z","official":false},{"id":3430424,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/13ea898d8b2efb86c3941cdd05695536?key=ActwzxnVsBTRj3O5ho87zdI%2F5S%2FDnGZ6mRiGxgqMT21l2tTmqPj3LD9%2B%2FMusw%2B51iihy1693dWvsoF3sVpGyjjKABlZMXU8FP3d%2B14gZy7rwObNz5gBt8WDb%2FVZG7u0DdGIUloKbwDFiK9e7EAinA241VwIbnrlp1MVLpMu8ZqfCSt2xcsCiF2k0","externalProvider":"github","login":"matheusfrancisco","type":"User","url":"https://github.com/matheusfrancisco"},"submittedAt":"2026-08-06T21:08:11Z","official":false},{"id":3430422,"state":"COMMENT","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"submittedAt":"2026-08-06T21:23:05Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":8,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false,"stack":{"source":"inferred","parent":{"number":1684,"title":"DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train","state":"open","isDraft":false,"baseBranch":"main","headBranch":"dep-91-tools","url":"https://trylle.com/hoophq/hoop/pulls/1684"},"children":[{"number":1687,"title":"DEP-91 (3/5): attach SBOM and bundled-tool manifest to releases","state":"open","isDraft":false,"baseBranch":"dep-91-gates","headBranch":"dep-91-sbom","url":"https://trylle.com/hoophq/hoop/pulls/1687"}],"siblings":[],"depth":1}},"fetchedAt":1793514563184}],"children":"$L7c"}] 64:null 6b:[["$","title","0",{"children":"Commits · DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck · hoophq/hoop | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck (#1686) in hoophq/hoop."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck · hoophq/hoop, hoophq/hoop, hoophq/hoop repository, hoop, Go repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/hoophq/hoop/pulls/1686/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/hoophq/hoop/pulls/1686/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck · hoophq/hoop | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck (#1686) in hoophq/hoop."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/hoophq/hoop/pulls/1686/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck · hoophq/hoop | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck (#1686) in hoophq/hoop."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","32",{"name":"twitter:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7d","36",{}]]

Commits on Mon, Aug 10, 2026