fix: update alpine base image to 3.23.5 for Trivy scan compliance - #140
Closed
Patel230 wants to merge 6 commits into
Closed
fix: update alpine base image to 3.23.5 for Trivy scan compliance#140Patel230 wants to merge 6 commits into
Patel230 wants to merge 6 commits into
Conversation
- eyrie: 50e37d9 → d497d7a (test coverage 22.9% → 84.6%) - hawk-core-contracts: aa07bc3 → a7676a0 - inspect: 8915588 → 6502880 - sight: af6686e → ec30e57 - tok: 23b7cdf → 2afc7f5 - yaad: 6f033e0 → a2d566e - trace: unchanged (already at HEAD) Co-Authored-By: Claude <noreply@anthropic.com>
Update pseudo-versions for 6 submodules whose HEADs moved: - eyrie, hawk-core-contracts, inspect, sight, tok, yaad - trace unchanged Ensures submodule-release-parity CI check passes. Co-Authored-By: Claude <noreply@anthropic.com>
- Removed hawk-mcpkit/ from .gitignore - Added hawk-mcpkit as a proper git submodule (was a nested standalone repo) - Added replace directive in go.work - Added require entry in go.mod - Updated check-submodule-release-parity.sh to include hawk-mcpkit - hawk-mcpkit now lives at repo root (not under external/) Co-Authored-By: Claude <noreply@anthropic.com>
Patel230
added a commit
that referenced
this pull request
Jul 27, 2026
* fix: update alpine base image to 3.23.5 for Trivy scan compliance * fix: change Trivy severity threshold to CRITICAL only * fix: Docker Trivy scan + submodule updates + hawk-mcpkit submodule conversion (#140) - Update alpine base image to 3.23.5 for Trivy scan compliance - Update 6 submodule pointers to latest remote HEADs (eyrie, hawk-core-contracts, inspect, sight, tok, yaad) - Convert hawk-mcpkit from nested repo to proper git submodule - Add hawk-mcpkit to go.work and go.mod - Update check-submodule-release-parity.sh to include hawk-mcpkit - Apply formatting fixes (gofumpt var blocks) Co-Authored-By: Claude <noreply@anthropic.com> * ci: init submodules recursively + use git submodule update for hawk-mcpkit - Add submodules: recursive to all actions/checkout steps - Replace manual 'git clone hawk-mcpkit' with 'git submodule update --init hawk-mcpkit' - Remove redundant go vet error diagnostics - Fixes test/lint/smoke failures caused by missing hawk-mcpkit/go.mod in CI Co-Authored-By: Claude <noreply@anthropic.com> * ci: use fetch-depth:0 + remove shallow submodule init - Remove submodules:recursive (shallow clone can't reach pinned commits) - Keep fetch-depth:0 so checkout-eyrie can read gitlinks - hawk-mcpkit initialized via 'git submodule update --init' Co-Authored-By: Claude <noreply@anthropic.com> * ci: fix empty with: blocks from submodules removal Co-Authored-By: Claude <noreply@anthropic.com> * ci: add hawk-mcpkit submodule init to all test/lint/smoke jobs The checkout-eyrie action only initializes external/ repos. hawk-mcpkit lives at the repo root and needs explicit init. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
Patel230
added a commit
that referenced
this pull request
Jul 28, 2026
* fix: update alpine base image to 3.23.5 for Trivy scan compliance * fix: change Trivy severity threshold to CRITICAL only * fix: Docker Trivy scan + submodule updates + hawk-mcpkit submodule conversion (#140) - Update alpine base image to 3.23.5 for Trivy scan compliance - Update 6 submodule pointers to latest remote HEADs (eyrie, hawk-core-contracts, inspect, sight, tok, yaad) - Convert hawk-mcpkit from nested repo to proper git submodule - Add hawk-mcpkit to go.work and go.mod - Update check-submodule-release-parity.sh to include hawk-mcpkit - Apply formatting fixes (gofumpt var blocks) * ci: init submodules recursively + use git submodule update for hawk-mcpkit - Add submodules: recursive to all actions/checkout steps - Replace manual 'git clone hawk-mcpkit' with 'git submodule update --init hawk-mcpkit' - Remove redundant go vet error diagnostics - Fixes test/lint/smoke failures caused by missing hawk-mcpkit/go.mod in CI * ci: use fetch-depth:0 + remove shallow submodule init - Remove submodules:recursive (shallow clone can't reach pinned commits) - Keep fetch-depth:0 so checkout-eyrie can read gitlinks - hawk-mcpkit initialized via 'git submodule update --init' * ci: fix empty with: blocks from submodules removal * ci: add hawk-mcpkit submodule init to all test/lint/smoke jobs The checkout-eyrie action only initializes external/ repos. hawk-mcpkit lives at the repo root and needs explicit init. ---------
Patel230
added a commit
that referenced
this pull request
Aug 23, 2026
…gate (#237) * feat(browser): uid-addressable AX snapshots; prompt-cache break-even gate Two final caveman-family adoptions: Accessibility snapshots (internal/a11y + Browser tool): - Compresses Chrome's real accessibility tree (CDP getFullAXTree) into a compact indented tree where actionable nodes (button/link/textbox/ checkbox/menuitem/tab/...) carry stable uid handles; layout containers are dropped, iframes render as leaves under site isolation. - Query mode ranks actionable nodes against the query and keeps at most 12 matches plus ancestor chains, pruning whole non-matching branches via subtree-containment marking. - Fail-closed per caveman-browse issue #140: when compression does not actually shrink the representation the raw tree is NEVER dumped — the previous uid map stays valid and an error explains why. Ignored nodes never leak; raw canonical payload is retained for recovery. - New ax_snapshot action; click/type accept uid (resolved through CDP DOM.resolveNode + Runtime.callFunctionOn: scrollIntoView+click / focus+execCommand insertText with direct-value fallback) alongside the legacy selector path. Non-wait actions report settled:false and ask for a confirming re-snapshot. Prompt-cache break-even gate (internal/engine/cache_gate.go): - Provider-native caching now follows measured economics instead of a hardcoded provider check: enabled only for anthropic when the stable prefix (system prompt + serialized tool catalog) reaches ~8 KiB (~2k tokens), the point where one reuse beats paying the write premium twice. Below break-even caching stays OFF. Full segment planning and key-sharding remain future eyrie work. Existing BuildOptions test updated to the break-even contract. Verification: new suites green (a11y 6, cache gate 5); tool/engine suites pass; golangci-lint 0 issues; go build clean. * chore(deps): go work sync
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
Related