SnapOtterandGitHub 5c75a93484 ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665) ...

Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run
in a real release (v2.1.0 had no archive-security job).

archive-security asserted tsx at the workspace root, but tsx is a prod dependency
of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the
Docker CMD runs it. The root path never existed and failed the extract step on
both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64
artifact.

The blocking Trivy scans would then have failed on CVE-2026-56852,
golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image,
compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules,
verified building in the golang:1.25.12 toolchain with -mod=readonly and linking
v0.39.0, with a clean Trivy rescan.

Guards added for both the tsx path and the x/text pin. Non-releasable type so a
re-dispatch re-runs 2.2.0.

2026-07-29 19:05:30 +08:00

..

container-policy.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

dependency-advisory-policy.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

docker-build-check.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

docker-file-secrets.test.ts

test: reorganize flat test files into purpose-based subdirectories (phase 6)

2026-06-20 05:07:46 +08:00

dockerfile-build-args.test.ts

ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665)

2026-07-29 19:05:30 +08:00

embedded-mode.test.ts

feat: all-in-one embedded single-container mode (#377)

2026-06-29 15:49:09 +08:00

entrypoint-permissions.test.ts

fix(docker): repair copied AI venv paths (#390)

2026-07-02 13:12:23 +08:00

security-auth-hardening.test.ts

Merge branch 'worktree-test+suite-overhaul-and-real-fixtures' into chore/consolidate-v2.0.0

2026-06-21 02:18:53 +08:00

security-error-handling.test.ts

test: reorganize flat test files into purpose-based subdirectories (phase 6)

2026-06-20 05:07:46 +08:00

security-file-processing.test.ts

test: reorganize flat test files into purpose-based subdirectories (phase 6)

2026-06-20 05:07:46 +08:00

security-input-validation.test.ts

Merge branch 'worktree-test+suite-overhaul-and-real-fixtures' into chore/consolidate-v2.0.0

2026-06-21 02:18:53 +08:00

security-network.test.ts

test: reorganize flat test files into purpose-based subdirectories (phase 6)

2026-06-20 05:07:46 +08:00

security-rate-limiting.test.ts

test: reorganize flat test files into purpose-based subdirectories (phase 6)

2026-06-20 05:07:46 +08:00

security-svg-sanitize.test.ts

fix(security): close the gaps a full 2.0 re-audit left open (#620)

2026-07-23 00:18:16 +08:00

trivy-unfixed-gate.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

trust-proxy-policy.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

trust-proxy-resolution.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00