feat(security): harden workflows, add triage SLAs, patch vulnerabilities (#2760)

Author: DerekRoberts

.github/ISSUE_TEMPLATE/security-triage.md

@@ -0,0 +1,25 @@
+---
+name: Security Vulnerability Triage
+about: Track and triage dependency or container vulnerability remediation.
+title: '[SECURITY] CVE-XXX: Package Name - Severity/SLA'
+labels: security
+assignees: ''
+---
+
+## Vulnerability Details
+- **CVE ID**: 
+- **Package**: 
+- **Vulnerability Link**: 
+- **CVSS Score**: 
+- **EPSS Score**: 
+
+## SLA Triage
+- [ ] Critical (24h)
+- [ ] High (1w)
+- [ ] Medium (2w)
+- [ ] Low (Next scheduled release)
+
+## Remediation Plan
+- [ ] Upgrade dependency version
+- [ ] Apply code fix / workaround
+- [ ] Document exception

.github/workflows/reusable-tests.yml

@@ -36,7 +36,25 @@ jobs:
             ${{ runner.os }}-build-
             ${{ runner.os }}-
 
-      - env:
+      - name: Wait for backend health check
+        env:
+          BASE_URL: https://${{ env.PREFIX }}.${{ env.DOMAIN }}
+        run: |
+          echo "Waiting for backend health check at ${BASE_URL}/api/health..."
+          for i in {1..30}; do
+            status=$(curl -k --connect-timeout 5 --max-time 10 -s -o /dev/null -w "%{http_code}" "${BASE_URL}/api/health" || true)
+            if [ "$status" -eq 200 ]; then
+              echo "Backend is healthy!"
+              exit 0
+            fi
+            echo "Waiting for health check (HTTP $status), retrying in 10s... ($i/30)"
+            sleep 10
+          done
+          echo "ERROR: Backend did not become healthy in time."
+          exit 1
+
+      - name: Run Integration Tests
+        env:
           API_NAME: nest
           BASE_URL: https://${{ env.PREFIX }}.${{ env.DOMAIN }}
         run: |

SECURITY.md

@@ -29,3 +29,12 @@ Out of the box, this QuickStart repository is hardened to satisfy Level 1 and Le
 | **V14.4** | HTTP Secure Headers | Strips identifying `Server` headers and enforces secure HTTP response headers (CSP, HSTS, X-Frame-Options, same-origin, and MIME sniffing blocks). | Configured natively in the frontend [frontend/Caddyfile](file:///home/derek/Repos/quickstart-openshift/frontend/Caddyfile) and verified by weekly OWASP ZAP scans. |
 | **V14.4** | Container Hardening | Restricts container execution permissions and prevents host system modifications. | Enforces `readOnlyRootFilesystem: true`, `runAsNonRoot: true`, `allowPrivilegeEscalation: false`, drop all `capabilities`, and default `seccompProfile` in [backend/openshift.deploy.yml](file:///home/derek/Repos/quickstart-openshift/backend/openshift.deploy.yml) and [frontend/openshift.deploy.yml](file:///home/derek/Repos/quickstart-openshift/frontend/openshift.deploy.yml). |
 | **V14.4** | Network Segmentation | Controls pod communication, isolating network traffic between frontend, backend, and database tiers. | Hardened [NetworkPolicies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) defined in [common/openshift.init.yml](file:///home/derek/Repos/quickstart-openshift/common/openshift.init.yml). |
+
+## Vulnerability Triage SLAs
+
+All security issues are triaged using CISA KEV status and CVSS scores:
+- **Critical** (CVSS 9.0-10.0 or CISA KEV): Remediation within 24 hours.
+- **High** (CVSS 7.0-8.9): Remediation within 1 week.
+- **Medium** (CVSS 4.0-6.9): Remediation within 2 weeks.
+- **Low** (CVSS 0.0-3.9): Remediation next scheduled release.
+

backend/package-lock.json

@@ -19,10 +19,7 @@ parameters:
   - name: MEMORY_LIMIT
     description: Memory limit for the database container (bounds the pod's working set).
     value: 4Gi
-  - name: RANDOM_EXPRESSION
-    description: Random expression to make sure deployments update
-    from: "[a-zA-Z0-9]{32}"
-    generate: expression
+
 objects:
   - apiVersion: apps/v1
     kind: StatefulSet
@@ -71,8 +68,7 @@ objects:
                     secretKeyRef:
                       name: ${NAME}-${ZONE}-database
                       key: database-user
-                - name: RANDOM_EXPRESSION
-                  value: ${RANDOM_EXPRESSION}
+
               volumeMounts:
                 - name: data
                   mountPath: /var/lib/postgresql/data