catalog: update Dune Ops Observability to v0.5.0 - #24
Closed
yacketrj wants to merge 10 commits into
Closed
Conversation
main's branch protection has required a "CI Gate" status check since this repo was created, but no workflow file defining that check has ever existed anywhere in this repo's history (confirmed via full tree search across every branch and GitHub code search across all commits, in both this fork and upstream Red-Blink/dune-docker-addons). Every PR against main, including #2, has been stuck in a permanently BLOCKED merge state as a result, despite being otherwise mergeable. Adds two files, sourced from PR #1 (feat/soc2-compliance), which already defined a working version of this exact workflow and had a green CI run recorded against it before that branch went stale: - .github/workflows/ci.yml: three jobs (Validate JSON, Security, CI Gate). CI Gate fans in the other two jobs' results and fails the overall check if either did not succeed, which is what main's branch protection actually polls for. - .github/dependabot.yml: weekly github-actions dependency updates, unrelated to CI Gate itself but bundled with it in the source branch and has no downsides to including here. Deliberately NOT included from PR #1's branch: compliance/README.md. That file is Arrakis-Control-Panel's SOC 2 compliance boilerplate, copied into this unrelated static-addon-catalog repo without adaptation -- it opens by name-checking "the ACP ecosystem" in a repo that is not ACP, and links to nine files (controls/soc2-matrix.md, five policy docs, four runbook docs) that do not exist anywhere in this repository. This repo has no runtime service, no user data, and nothing to run a SOC 2 audit against, so a compliance program does not fit its actual scope. Left out here rather than landing broken links and a wrong-repo-name doc on main; PR #1 remains open for separate review of that content. Also fixes two dependency-freshness problems in the workflow, found while validating it would actually keep working going forward rather than just checking it ran once historically: - gitleaks/gitleaks-action@v2 to @V3. v2 runs on the Node 20 Actions runtime, which GitHub already requires an explicit opt-out flag for as of 2026-06-02 and removes entirely on 2026-09-16 -- about seven weeks from this commit. v3 has no input/output/behavior changes per the action's own migration note, just the Node 24 runtime bump. - returntocorp/semgrep-action@v1 replaced with running the semgrep CLI directly via its official Docker image. Both returntocorp/semgrep- action and its semgrep/semgrep-action successor are explicitly marked deprecated by their own READMEs ("stop using this wrapper script... migrate to native Semgrep support instead"); running the CLI directly is semgrep's own current recommended CI approach and avoids depending on an unmaintained wrapper at all. Verified locally before committing: - python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))" and the same for dependabot.yml: both parse as valid YAML. - python3 -c "import json; json.load(open('index.json'))" and the equivalent find/loop over addons/*.json: both pass against this repo's current content, confirming the Validate JSON job's own logic is correct against real data, not just syntactically present. - gitleaks detect --source . -v: 81 commits scanned, no leaks found. - semgrep --config p/security-audit --error . (installed locally, version 1.168.0): 0 findings, exit 0. - docker run --rm -v "$PWD:/src" semgrep/semgrep semgrep --config p/security-audit --error /src: ran the exact command this workflow uses, confirmed 0 findings and exit code 0.
ci: add CI Gate workflow required by branch protection
Add project funding options
…on PRs) Fork-local addition only -- does not touch tracked upstream catalog content (addons/, index.json). Complements the existing ci.yml's Docker-invoked semgrep --config p/security-audit (Community-tier, no login) with logged-in semgrep ci (Pro rules + Supply Chain).
ci: add Semgrep CI workflow (full ruleset + Supply Chain)
v0.5.0 — Phase 0: Tab-Aware Lazy Loading & Grafana Fix - Tab-aware lazy loading (active tab dispatches only its providers) - Placeholder tabs (AAA, NOC Infra, Audit Log) for L1-designed metrics - Grafana HTTPS/HTTP mode toggle with mixed-content explanation - Inventory layout fix (4th metric card, empty state) - Freshness badges, NOC service table, CSP frame-src fix - L2+L3 Eight-Hat Audit completed, 57/57 tests pass
Contributor
Author
L3 Integration Audit — 2026-08-08Per Requirement 20, a Layer 3 eight-hat audit was completed against the full v0.5.1 release diff. 18/18 checks pass. 0 CRITICAL, 0 HIGH. Evidence
Audit Summary
|
Contributor
Author
|
Closed per operator request — will be resubmitted after fixes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the Dune Ops Observability addon from v0.4.7 → v0.5.0.
Changes
Testing
Release
Operator Impact
Additive only. No breaking changes. Operators on v0.4.7 can install v0.5.0 with zero config changes.
Draft Status
Per the upstream PR policy (Requirement 19), this PR remains in draft until: