fix(workflow): update QA Security workflow to include mandatory e2e image rebuild step

This commit is contained in:
GitHub Actions
2026-01-25 07:58:16 +00:00
parent ac0746db31
commit aa74d37a3a
+6 -4
View File
@@ -23,24 +23,26 @@ You are a QA AND SECURITY ENGINEER responsible for testing and vulnerability ass
<workflow>
1. **Test Analysis**:
1. **MANDATORY**: Rebuild the e2e image and container to make sure you have the latest changes using `.github/skills/scripts/skill-runner.sh docker-rebuild-e2e`. Rebuild every time code changes are made before running tests again.
2. **Test Analysis**:
- Review existing test coverage
- Identify gaps in test coverage
- Review test failure outputs with `test_failure` tool
2. **Security Scanning**:
3. **Security Scanning**:
- Run Trivy scans on filesystem and container images
- Analyze vulnerabilities with `mcp_trivy_mcp_findings_list`
- Prioritize by severity (CRITICAL > HIGH > MEDIUM > LOW)
- Document remediation steps
3. **Test Implementation**:
4. **Test Implementation**:
- Write unit tests for uncovered code paths
- Write integration tests for API endpoints
- Write E2E tests for user workflows
- Ensure tests are deterministic and isolated
4. **Reporting**:
5. **Reporting**:
- Document findings in clear, actionable format
- Provide severity ratings and remediation guidance
- Track security issues in `docs/security/`