From db75bf7bf9de6873b7d214f33201c49e604534bb Mon Sep 17 00:00:00 2001
From: Mark Shine <72512363+CodeStaple@users.noreply.github.com>
Date: Fri, 1 May 2026 20:16:56 +0200
Subject: [PATCH 1/5] Update generated files via Ankra

---
 .github/workflows/ci.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c999dba..16d11e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
         run: npm test
         env:
           NODE_ENV: test
-          JWT_SECRET: "${{ secrets.JWT_SECRET }}"
+          JWT_SECRET: ci-test-demo-secret
           STORAGE_BACKEND: json
 
       - name: Check for vulnerabilities
@@ -50,10 +50,10 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: [REDACTED:high_entropy:21b90074]@v3
+        uses: docker/setup-buildx-action@v3
 
       - name: Build image for scanning
-        uses: [REDACTED:high_entropy:3e3fdc23]@v5
+        uses: docker/build-push-action@v5
         with:
           context: .
           push: false
@@ -106,7 +106,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: [REDACTED:high_entropy:21b90074]@v3
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
         uses: docker/login-action@v3
@@ -125,7 +125,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push
-        uses: [REDACTED:high_entropy:3e3fdc23]@v5
+        uses: docker/build-push-action@v5
         with:
           context: .
           push: true

From 6d2adca18e2167f58b3e6c729f96c44201645ab9 Mon Sep 17 00:00:00 2001
From: Mark Shine <72512363+CodeStaple@users.noreply.github.com>
Date: Fri, 1 May 2026 20:22:24 +0200
Subject: [PATCH 2/5] Update generated files via Ankra

---
 chart/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chart/values.yaml b/chart/values.yaml
index 64a34fb..ea520d2 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -84,7 +84,7 @@ env:
 
 # Sensitive environment variables sourced from Kubernetes Secrets
 # Create the secret first:
-#   kubectl create secret generic isms-builder-secrets [REDACTED:high_entropy:759cd97e]
+#   kubectl create secret generic isms-builder-secrets --from-literal=jwt-secret=YOUR_SECRET_HERE
 secretEnv:
   JWT_SECRET:
     secretName: isms-builder-secrets

From 9927d339589d985b2889128a36ff755d350dc1b3 Mon Sep 17 00:00:00 2001
From: Mark Shine <72512363+CodeStaple@users.noreply.github.com>
Date: Fri, 1 May 2026 20:25:04 +0200
Subject: [PATCH 3/5] Update generated files via Ankra

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 16d11e8..9ddca56 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,6 +68,7 @@ jobs:
           exit-code: 1
           severity: CRITICAL,HIGH
           ignore-unfixed: true
+          skip-dirs: /usr/local/lib/node_modules
 
       - name: Trivy - Helm chart misconfiguration scan
         uses: aquasecurity/trivy-action@master

From 77f91e568a6f85f83055a6c3f2d031248b93f5ab Mon Sep 17 00:00:00 2001
From: Mark Shine <72512363+CodeStaple@users.noreply.github.com>
Date: Fri, 1 May 2026 20:30:55 +0200
Subject: [PATCH 4/5] Update generated files via Ankra

---
 .github/workflows/ci.yml | 2 +-
 .trivyignore             | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 .trivyignore

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ddca56..84fffad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,7 +68,7 @@ jobs:
           exit-code: 1
           severity: CRITICAL,HIGH
           ignore-unfixed: true
-          skip-dirs: /usr/local/lib/node_modules
+          trivyignores: .trivyignore
 
       - name: Trivy - Helm chart misconfiguration scan
         uses: aquasecurity/trivy-action@master
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..d101eff
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,9 @@
+# Base image system npm vulnerabilities (node:lts-alpine)
+# These are in /usr/local/lib/node_modules/npm/ — NOT app dependencies.
+# Safe to ignore until the base image is updated.
+
+# path-to-regexp: ReDoS via malformed URL parameters (system npm)
+CVE-2026-4867
+
+# picomatch: ReDoS via crafted extglob patterns (system npm)
+CVE-2026-33671
\ No newline at end of file

From 4853e93bc685d7a25f963dd4936e51dc663979ba Mon Sep 17 00:00:00 2001
From: Mark Shine <72512363+CodeStaple@users.noreply.github.com>
Date: Sat, 2 May 2026 14:47:13 +0200
Subject: [PATCH 5/5] Update generated files via Ankra

---
 chart/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chart/values.yaml b/chart/values.yaml
index ea520d2..08c59be 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -28,7 +28,7 @@ securityContext:
   capabilities:
     drop:
     - ALL
-  readOnlyRootFilesystem: false
+  readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 1000