Repository navigation
Allow the reviewed HIGH/CRITICAL scan gate for Payload dev only - #47
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Payload dev currently stops at image publication because its image has MEDIUM findings. Add the explicitly requested
payload-dev-high-criticalpolicy to the reviewed Python publisher so Payload dev can report MEDIUM findings while continuing to block HIGH, CRITICAL and UNDEFINED findings.The policy is opt-in and restricted to
github.com/topcoder-platform/payload-cms, environmentdev, branchdevelop, and the exact Payload service, task family and image mapping. Production and other services cannot select it; all existing callers remain strict. There is no CLI or environment-variable switch. Scan freshness, completion, response validation, immutable tags and exact artifact verification still apply. No IAM changes or secret access are needed.Validation: all 98 tests pass offline in the pinned CircleCI AWS executor. New cases cover the allowed dev policy, reporting, default strict behavior, forbidden production/other targets, unknown policies, blocked severities, and unchanged scan/artifact checks.
Release coordination: merge to
masterand publish v2.0.7 before enabling the matching Payload adapter change. Payload will also upgrade Next.js to 16.4.5, whose release notes list fixes for its three current Next.js findings; deepmerge remains an upstream finding reported by the dev policy.