- Introduced markdown content rules and validation requirements in markdown.instructions.md
- Added React controls and platform libraries guidelines in pcf-react-platform-libraries.instructions.md
- Created extensive performance optimization instructions covering frontend, backend, and database best practices in performance-optimization.instructions.md
- Established Playwright test writing guidelines and structure in playwright-typescript.instructions.md
- Developed secure coding practices based on OWASP Top 10 in security-and-owasp.instructions.md
- Defined directives for managing Copilot interactions and code generation in taming-copilot.instructions.md
- Provided TypeScript 5.x and ES2022 development guidelines in typescript-5-es2022.instructions.md
- Add timeout-minutes: 5 to docker-build.yml integration test step
- Add set -o pipefail to integration-test.sh
- Add 4-minute timeout wrapper (INTEGRATION_TEST_TIMEOUT env var)
Resolves hang after Caddy TLS cleanup in GitHub Actions run #20319807650
GitHub's github.ref_name returns "421/merge" for PR merge refs,
creating invalid Docker tags like "pr-421/merge". Docker tags
cannot contain forward slashes.
Changed to use github.event.pull_request.number which returns
just the PR number (e.g., "421") for valid tags like "pr-421".
Fixes CI/CD failure in PR #421.
- Move slow hooks (go-test-coverage, frontend-type-check) to manual stage
- Reduce pre-commit execution time from hanging to ~8 seconds (75% improvement)
- Expand Definition of Done with explicit coverage testing requirements
- Update all 6 agent modes to verify coverage before task completion
- Fix typos in agent files (DEFENITION → DEFINITION)
- Fix version mismatch in .version file
- Maintain 85% coverage requirement for both backend and frontend
- Coverage tests now run via VS Code tasks or manual scripts
Verification: All tests pass, coverage maintained at 85%+, CI integrity preserved
The docker-publish.yml workflow was missing pull:true, causing it
to use cached Alpine images with vulnerable c-ares 1.34.5-r0.
This completes the fix across all three Docker workflows:
- docker-build.yml ✓
- docker-publish.yml ✓ (this commit)
- security-weekly-rebuild.yml ✓
Resolves CVE-2025-62408 (c-ares)
Ensures all Docker builds pull fresh Alpine base images to get
security patches like c-ares 1.34.6-r0 (CVE-2025-62408).
This mirrors the change made to security-weekly-rebuild.yml.
Without pull:true, the weekly security rebuild may use stale base
images cached on GitHub runners, missing security patches like
c-ares 1.34.6-r0 (CVE-2025-62408).
This update revises the planning document to address the c-ares security vulnerability (CVE-2025-62408) and removes the previous analysis regarding Go version compatibility issues. The document now emphasizes the need to rebuild the Docker image to pull the patched version of c-ares from Alpine repositories, with no Dockerfile changes required.
Key changes include:
- Removal of outdated Go version mismatch analysis.
- Addition of details regarding the c-ares vulnerability and its impact.
- Streamlined focus on remediation steps and testing checklist.
