9 Commits

Include renames

Author	SHA1	Message	Date
mrhid6	eee236a072	fix: tidy server go.mod for the vulnerability database dependencies ... trivy-db, oras-go, the three version comparators and robfig/cron were recorded as indirect with an incomplete go.sum, which builds locally against a warm module cache but fails in CI with "updates to go.mod needed". trivy-db pulls testify into the build graph, and its hashes were missing entirely.	2026-08-06 15:18:57 +01:00
mrhid6	5dda3b5c4a	feat: vulnerability scanning pipeline, matcher, scheduler and API ... Completes tasks 10-15 and fixes what was outstanding: - vulndb.Pull implemented with oras-go, streaming the ~50MB layer and staging both files before replacing either, so a failed pull leaves the previous database intact rather than a half-written one. - db.go: Vulnerability.Severity is a string, not trivy Severity, so the int conversion did not compile. Severity now resolves vendor (highest when vendors disagree) then NVD then unknown, and CVSS is read too. - findings.go: added sweepFixedFindings plus the fleet query, severity counts, rescan flag and accept/unaccept the API needs. - vulnrules.go: added rule CRUD and the digest builder. ResolveTargets returns []models.Server, not []string, so filterByServers was wrong. - api/vulnerabilities.go was an empty file while handlers.go registered twelve routes against it; written, grouped by CVE. - shared/mail: added the missing sender. The templates were orphaned and the HTML one was a copy of the text one, defining "subject" (which html/template would escape) and emitting no markup. render.go parses every template in init(), so a bad one panics server, admin and sitesvc at boot — go build never runs init(), which is why nothing complained. - notify: digests dispatch through their own path so SMTP gets the digest template rather than arriving dressed as a monitor alert.	2026-08-06 14:33:46 +01:00
mrhid6	bd24b03cac	feat: version comparators for distro package ordering	2026-08-06 11:54:13 +01:00
mrhid6	d0e1cc4ad6	feat: cron arithmetic and persisted workflow schedules	2026-08-04 13:51:10 +01:00
mrhid6	eb8b85ccfe	fix(server): add the lk go.sum entry the workspace was masking ... go build inside the Docker image runs outside the workspace, so server/go.sum needed the hyperboloide/lk entry that GOWORK resolution was supplying locally. Caught by the image build, not by go build.	2026-07-24 15:35:01 +01:00
mrhid6	76d3111a72	refactor(server): use shared models, provision and indexes ... Also removes the duplicate Slugify in stepscan.go; workflow step slugs now use the shared definition too.	2026-07-24 13:42:44 +01:00
mrhid6	9ec3cbf901	feat: add wwt/guac dep and guacd service	2026-07-17 11:21:58 +01:00
domrichardson	aaf154168e	updates	2026-06-15 16:20:26 +01:00
domrichardson	c9868b2108	first commit	2026-06-15 13:58:45 +01:00