The docker-publish.yml workflow was missing pull:true, causing it
to use cached Alpine images with vulnerable c-ares 1.34.5-r0.
This completes the fix across all three Docker workflows:
- docker-build.yml ✓
- docker-publish.yml ✓ (this commit)
- security-weekly-rebuild.yml ✓
Resolves CVE-2025-62408 (c-ares)
Ensures all Docker builds pull fresh Alpine base images to get
security patches like c-ares 1.34.6-r0 (CVE-2025-62408).
This mirrors the change made to security-weekly-rebuild.yml.
Without pull:true, the weekly security rebuild may use stale base
images cached on GitHub runners, missing security patches like
c-ares 1.34.6-r0 (CVE-2025-62408).
This update revises the planning document to address the c-ares security vulnerability (CVE-2025-62408) and removes the previous analysis regarding Go version compatibility issues. The document now emphasizes the need to rebuild the Docker image to pull the patched version of c-ares from Alpine repositories, with no Dockerfile changes required.
Key changes include:
- Removal of outdated Go version mismatch analysis.
- Addition of details regarding the c-ares vulnerability and its impact.
- Streamlined focus on remediation steps and testing checklist.
- Add .github/workflows/docs-to-issues.yml to convert docs/issues/*.md to GitHub Issues
- Support YAML frontmatter for title, labels, priority, assignees, milestone
- Auto-create missing labels with predefined color scheme
- Support sub-issue creation from H2 sections (create_sub_issues: true)
- Move processed files to docs/issues/created/ to prevent duplicates
- Add dry-run and manual file selection workflow inputs
- Add _TEMPLATE.md with frontmatter documentation
- Add README.md with usage instructions
- Add implementation plan at docs/plans/docs_to_issues_workflow.md
- Added safeIntToUint and safeFloat64ToUint functions to prevent integer overflow in proxy_host_handler.go.
- Updated GetAvailableSpace method in backup_service.go with overflow protection.
- Improved LiveLogViewer tests by using findBy queries to avoid race conditions.
- Adjusted benchmark.yml to handle permissions and increased alert threshold to 175%.
- Created CI/CD Failure Remediation Plan document for addressing workflow failures.
- Created `qa-test-output-after-fix.txt` and `qa-test-output.txt` to log results of certificate page authentication tests.
- Added `build.sh` for deterministic backend builds in CI, utilizing `go list` for efficiency.
- Introduced `codeql_scan.sh` for CodeQL database creation and analysis for Go and JavaScript/TypeScript.
- Implemented `dockerfile_check.sh` to validate Dockerfiles for base image and package manager mismatches.
- Added `sourcery_precommit_wrapper.sh` to facilitate Sourcery CLI usage in pre-commit hooks.
