Skip to content

docs: fix traceability matrix doc_id collision with production quality#579

Merged
kcenon merged 2 commits into
mainfrom
docs/issue-566-feature-test-module-traceability
Apr 4, 2026
Merged

docs: fix traceability matrix doc_id collision with production quality#579
kcenon merged 2 commits into
mainfrom
docs/issue-566-feature-test-module-traceability

Conversation

@kcenon

@kcenon kcenon commented Apr 4, 2026

Copy link
Copy Markdown
Owner

Summary

  • Fix doc_id collision: TRACEABILITY.md and PRODUCTION_QUALITY.md both used COM-QUAL-002
  • Assign unique COM-QUAL-003 to TRACEABILITY.md (next available QUAL number)
  • Update SSOT registry (docs/README.md) to reflect the corrected doc_id

Closes #566

What

The traceability matrix document (docs/TRACEABILITY.md) was sharing COM-QUAL-002 with PRODUCTION_QUALITY.md. Each document in the SSOT registry must have a unique doc_id. This PR assigns COM-QUAL-003 to the traceability matrix.

How

  • Updated doc_id in docs/TRACEABILITY.md YAML frontmatter from COM-QUAL-002 to COM-QUAL-003
  • Updated both entries in docs/README.md (numbered table and category index)

Test Plan

  • Verify COM-QUAL-003 is not used by any other document
  • Verify TRACEABILITY.md YAML frontmatter matches README.md registry entry
  • Verify all feature-test mappings are accurate (test files exist)
  • Verify coverage summary totals match actual feature count (35)

@kcenon
docs: fix traceability matrix doc_id collision with production quality
4231e20 
Both PRODUCTION_QUALITY.md and TRACEABILITY.md were using COM-QUAL-002.
Changed TRACEABILITY.md to COM-QUAL-003 to ensure unique doc_ids.
Updated SSOT registry in README.md accordingly.
@kcenon kcenon mentioned this pull request Apr 4, 2026
Closed
6 tasks
@kcenon

kcenon commented Apr 4, 2026

Copy link
Copy Markdown
Owner Author

CI/CD Failure Analysis

Analysis Time: 2026-04-04 UTC
Attempt: #1

Failed Workflows

Workflow Job Step Status
SBOM Generation generate-sbom Scan SBOM for CVEs with Grype Failed

Root Cause Analysis

Primary Error:

[ERROR] discovered vulnerabilities at or above the severity threshold
Failed minimum severity level. Found vulnerabilities with level 'high' or higher

Analysis:
Grype vulnerability scanner (v0.110.0) found GHSA-cxww-7g56-2vh6 (CVE-2024-42471) - a high-severity path traversal vulnerability in actions/download-artifact versions < 4.1.7.

The SBOM workflow uses fail-build: true for pull requests, which blocks the PR when any high+ severity CVE is detected. This is not caused by the PR's changes — it's a pre-existing issue where Syft catalogs GitHub Actions references from workflow YAML files into the SBOM, and Grype flags the floating @v4 tag as potentially vulnerable since it cannot resolve the tag to a specific patched version.

Identified Issues:

  1. actions/download-artifact@v4 in doc-audit-ecosystem.yml flagged as GHSA-cxww-7g56-2vh6
  2. No .grype.yaml configuration exists to manage known false positives

Proposed Fix

Issue Proposed Solution Files Affected
Grype false positive for floating Action tags Create .grype.yaml with ignore rule for GHSA-cxww-7g56-2vh6 (GitHub Action version resolved at runtime) .grype.yaml

Next Steps

  • Create .grype.yaml with appropriate ignore configuration
  • Push and monitor CI

Automated failure analysis - Attempt #1

@kcenon
ci(sbom): add grype ignore for GHSA-cxww-7g56-2vh6 false positive
a0a9e2e 
Syft catalogs GitHub Actions references from workflow YAML into the SBOM
using floating tags (e.g., @v4). Grype cannot resolve these to actual
versions at scan time, so actions/download-artifact@v4 is flagged as
vulnerable even though the @v4 tag resolves to a patched release (>= 4.1.8)
at runtime.

Add .grype.yaml with an ignore rule for this specific advisory to prevent
false positive CI failures.
@kcenon kcenon merged commit 66c1a19 into main Apr 4, 2026
29 checks passed
@kcenon kcenon deleted the docs/issue-566-feature-test-module-traceability branch April 4, 2026 15:40
kcenon added a commit that referenced this pull request Apr 13, 2026
@kcenon
docs: fix traceability matrix doc_id collision with production quality (
ca55ea5 
#579)

* docs: fix traceability matrix doc_id collision with production quality

Both PRODUCTION_QUALITY.md and TRACEABILITY.md were using COM-QUAL-002.
Changed TRACEABILITY.md to COM-QUAL-003 to ensure unique doc_ids.
Updated SSOT registry in README.md accordingly.

* ci(sbom): add grype ignore for GHSA-cxww-7g56-2vh6 false positive

Syft catalogs GitHub Actions references from workflow YAML into the SBOM
using floating tags (e.g., @v4). Grype cannot resolve these to actual
versions at scan time, so actions/download-artifact@v4 is flagged as
vulnerable even though the @v4 tag resolves to a patched release (>= 4.1.8)
at runtime.

Add .grype.yaml with an ignore rule for this specific advisory to prevent
false positive CI failures.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

docs: Create feature-test-module traceability matrices

1 participant

@kcenon