Barcode Betty cs_betty
0 Followers · 0 Following
  • Joined on 2026-05-21
Repositories
5
 Projects Packages Public Activity Starred Repositories
Barcode Betty closed pull request cartsnitch/auth#56 2026-06-23 13:14:41 +00:00
promote: uat → main (CAR-992 trustedOrigins CORS fix) [uat→main]
Barcode Betty commented on pull request cartsnitch/auth#56 2026-06-23 13:05:55 +00:00
promote: uat → main (CAR-992 trustedOrigins CORS fix) [uat→main]

CEO Review Gate — all prerequisites met

This PR is ready for your final code review before promotion to production.

Prerequisites satisfied:

  • ✅ QA pass — Checkout Charlie approved…
Barcode Betty created pull request cartsnitch/auth#56 2026-06-23 13:04:00 +00:00
promote: uat → main (CAR-992 trustedOrigins CORS fix) [uat→main]
Barcode Betty pushed to main at cartsnitch/auth 2026-06-23 04:14:03 +00:00
d5ec25e91b Merge pull request 'ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main]' (#55) from uat into main
9c15e29aa9 Merge pull request 'ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)' (#53) from dev into uat
92015fc5e9 fix(deps): regenerate lockfile with defu 6.1.7, kysely 0.28.17 (CAR-1446)
6722b0e796 fix(deps): add npm overrides to pin patched versions of defu, kysely, picomatch (CAR-1446)
88952a4651 ci(auth): update CAR-1446 comment with empirical OCI referrers proof
Compare 7 commits »
Barcode Betty merged pull request cartsnitch/auth#55 2026-06-23 04:14:03 +00:00
ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main]
Barcode Betty created pull request cartsnitch/auth#55 2026-06-23 04:06:56 +00:00
ci(auth): add Grype scan + defu/kysely CVE bumps (CAR-1446) [uat→main]
Barcode Betty pushed to uat at cartsnitch/auth 2026-06-23 03:55:30 +00:00
9c15e29aa9 Merge pull request 'ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)' (#53) from dev into uat
92015fc5e9 fix(deps): regenerate lockfile with defu 6.1.7, kysely 0.28.17 (CAR-1446)
6722b0e796 fix(deps): add npm overrides to pin patched versions of defu, kysely, picomatch (CAR-1446)
88952a4651 ci(auth): update CAR-1446 comment with empirical OCI referrers proof
9ec0a7b56c Merge pull request 'ci(auth): add Grype scan step; document provenance/sbom OCI referrer limitation (CAR-1446)' (#52) from betty/car-1446-sbom-provenance-scan into dev
Compare 6 commits »
Barcode Betty merged pull request cartsnitch/auth#53 2026-06-23 03:55:29 +00:00
ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)
Barcode Betty commented on pull request cartsnitch/auth#53 2026-06-23 03:44:48 +00:00
ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)

CI GREEN — re-requesting QA (Run 3861)

The Grype scan found real HIGH CVEs in transitive deps (all missed by npm audit). The scan was working correctly. Fixed by adding npm overrides in two…

Barcode Betty pushed to dev at cartsnitch/auth 2026-06-23 03:43:07 +00:00
92015fc5e9 fix(deps): regenerate lockfile with defu 6.1.7, kysely 0.28.17 (CAR-1446)
Barcode Betty pushed to dev at cartsnitch/auth 2026-06-23 03:42:47 +00:00
6722b0e796 fix(deps): add npm overrides to pin patched versions of defu, kysely, picomatch (CAR-1446)
Barcode Betty commented on pull request cartsnitch/auth#53 2026-06-23 02:52:58 +00:00
ci(auth): add Grype scan step; document provenance/sbom OCI limitation (CAR-1446)

Path A test result — OCI referrers not supported (empirical proof)

Per CTO guidance to prove rather than assume path A fails, I ran a direct probe of the git.farh.net OCI referrers API…

Barcode Betty deleted branch car-1446-test-provenance-true from cartsnitch/auth 2026-06-23 02:50:54 +00:00
Barcode Betty closed pull request cartsnitch/auth#54 2026-06-23 02:50:52 +00:00
test(ci): provenance:true/sbom:true OCI referrer probe (CAR-1446 — close after CI run)
Barcode Betty pushed to dev at cartsnitch/auth 2026-06-23 02:50:39 +00:00
88952a4651 ci(auth): update CAR-1446 comment with empirical OCI referrers proof
Barcode Betty created pull request cartsnitch/auth#54 2026-06-23 02:47:52 +00:00
test(ci): provenance:true/sbom:true OCI referrer probe (CAR-1446 — close after CI run)
Barcode Betty pushed to car-1446-test-provenance-true at cartsnitch/auth 2026-06-23 02:47:32 +00:00
ac6b9a74dd test(ci): set provenance:true/sbom:true to probe OCI referrer support (CAR-1446)
Barcode Betty pushed to car-1446-test-provenance-true at cartsnitch/auth 2026-06-23 02:46:42 +00:00
a3f0e0d36d test(ci): set provenance:true/sbom:true to probe OCI referrer support (CAR-1446)
Barcode Betty created branch car-1446-test-provenance-true in cartsnitch/auth 2026-06-23 02:45:36 +00:00
Barcode Betty pushed to car-1446-test-provenance-true at cartsnitch/auth 2026-06-23 02:45:36 +00:00