Merge branch 'main' into dependabot/cargo/src/crates/netipc/rust-dependencies-970ce90138

Author: ktsaou

.agents/sow/done/SOW-0008-20260602-sync-topology-containers-vendor-drift.md

@@ -4,7 +4,8 @@
 
 Status: completed
 
-Sub-state: source sync, validation, artifact maintenance, and follow-up mapping are complete.
+Sub-state: reopened regression, repair, validation, artifact maintenance, and
+follow-up mapping are complete.
 
 ## Requirements
 
@@ -463,3 +464,122 @@ Append regression entries here only after this SOW was completed or closed and
 later testing or use found broken behavior. Use a dated `## Regression -
 YYYY-MM-DD` heading at the end of the file. Never prepend regression content
 above the original SOW narrative.
+
+## Regression - 2026-06-02
+
+Status: completed
+
+What broke:
+
+- A new vendor diff appeared after the SOW was completed.
+- The drift is limited to
+  `src/libnetdata/netipc/src/protocol/netipc_protocol.c`.
+- The C apps lookup static assertion still depended on the naturally padded
+  `sizeof(nipc_apps_lookup_item_wire_t) == 64u` instead of asserting the fixed
+  60-byte wire header boundary directly.
+
+Evidence:
+
+- `./diff-netdata-vendor.sh <topology-containers-tree> --unified` reported
+  only this C file after expected exclusions and Go import normalization.
+- `ktsaou/netdata @ 8b652640fdeea7533bf81789d5119073c82b3b61`
+  `src/libnetdata/netipc/src/protocol/netipc_protocol.c` asserts that
+  `reserved1` ends at `NIPC_APPS_LOOKUP_ITEM_HDR_SIZE` and that the C struct
+  covers at least that fixed header size.
+- `docs/codec-apps-lookup.md` records `NIPC_APPS_LOOKUP_ITEM_HDR_SIZE: 60`
+  and explicitly says C must use explicit wire-size constants rather than
+  `sizeof(struct)` as the apps item wire length.
+- `src/libnetdata/netipc/include/netipc/netipc_protocol.h` defines
+  `NIPC_APPS_LOOKUP_ITEM_HDR_SIZE` as `60u`.
+
+Why previous validation missed it:
+
+- Previous validation was correct for the checked downstream revision at SOW
+  completion time.
+- The checked topology containers tree later moved to
+  `8b652640fdeea7533bf81789d5119073c82b3b61`, adding this narrower static
+  assertion.
+
+Repair plan:
+
+1. Replace the padded `sizeof == 64u` assertion with explicit fixed-header
+   boundary and minimum-coverage assertions.
+2. Run focused C protocol validation.
+3. Re-run the vendor diff script against the checked topology containers tree.
+4. Close this regression only after validation and artifact maintenance are
+   recorded.
+
+Validation plan:
+
+- Build `test_protocol` if the existing build tree can compile it.
+- Run `ctest --test-dir build -R '^test_protocol$' --output-on-failure`.
+- Run `./diff-netdata-vendor.sh <topology-containers-tree>`.
+- Check SOW status/directory consistency and unrelated worktree changes.
+
+Artifact updates needed:
+
+- AGENTS.md: no update expected; this does not change project workflow.
+- Runtime project skills: no update expected; no runtime `project-*` skills
+  exist.
+- Specs: no update expected; `docs/codec-apps-lookup.md` already records the
+  exact wire-size rule this change enforces.
+- End-user/operator docs: no update expected; this is internal assertion
+  hygiene with no public behavior change.
+- End-user/operator skills: no update expected; public integration guidance is
+  unchanged.
+- SOW lifecycle: this SOW was reopened in `.agents/sow/current/`, validated,
+  marked `Status: completed`, and moved back to `.agents/sow/done/`.
+
+Repair performed:
+
+- Replaced the padded `sizeof(nipc_apps_lookup_item_wire_t) == 64u` assertion
+  with:
+  - an assertion that `reserved1` ends at `NIPC_APPS_LOOKUP_ITEM_HDR_SIZE`
+    byte 60;
+  - an assertion that the C struct covers at least the fixed wire header size.
+
+Validation results:
+
+- `cmake --build build --target test_protocol`: passed.
+- `ctest --test-dir build -R '^test_protocol$' --output-on-failure`: failed
+  before running tests because `~/.local/bin/ctest` is a Python wrapper
+  missing the `cmake` module.
+- `/usr/bin/ctest --test-dir build -R '^test_protocol$' --output-on-failure`:
+  passed; `test_protocol` passed.
+- `./diff-netdata-vendor.sh <topology-containers-tree>`: passed; no C, Rust,
+  or Go source differences remain after expected exclusions and Go import-path
+  normalization.
+- Same-failure search:
+  `rg -n "sizeof\\(nipc_apps_lookup_item_wire_t\\)|fixed wire header must end|struct must cover the fixed wire header|NIPC_APPS_LOOKUP_ITEM_HDR_SIZE" src/libnetdata/netipc/src/protocol/netipc_protocol.c docs/codec-apps-lookup.md src/libnetdata/netipc/include/netipc/netipc_protocol.h`
+  confirmed the old exact `sizeof` assertion is gone and the implementation,
+  public header constant, and spec agree on the 60-byte wire header.
+
+Artifact maintenance gate:
+
+- AGENTS.md: no update needed; validation surfaced a local PATH wrapper issue,
+  not a reusable project workflow change.
+- Runtime project skills: no update needed; no runtime `project-*` skills
+  exist.
+- Specs: no update needed; `docs/codec-apps-lookup.md` already requires
+  explicit wire-size constants and records `NIPC_APPS_LOOKUP_ITEM_HDR_SIZE` as
+  60.
+- End-user/operator docs: no update needed; this changes an internal C compile
+  assertion only.
+- End-user/operator skills: no update needed; public integration guidance is
+  unchanged.
+- SOW lifecycle: reopened from `.agents/sow/done/` to `.agents/sow/current/`,
+  marked `Status: completed` after validation, and moved back to
+  `.agents/sow/done/` with the source fix.
+
+Follow-up mapping:
+
+- No follow-up work is required.
+- The `ctest` PATH wrapper failure is unrelated to this source change; the
+  validation was completed with `/usr/bin/ctest`, so no source follow-up is
+  required for this SOW.
+
+Outcome:
+
+- Completed. The upstream repository again matches the checked topology
+  containers vendored NetIPC source after expected exclusions and Go import-path
+  normalization.

.agents/sow/done/SOW-0009-20260602-github-security-scanning.md

@@ -4,7 +4,7 @@
 
 Status: completed
 
-Sub-state: GitHub scanner automation, local scanner tools, repository secret scanning settings, and validation are complete.
+Sub-state: GitHub scanner automation is complete; scanner and runtime first-run regressions were repaired and validated locally.
 
 ## Requirements
 
@@ -322,3 +322,64 @@ Tracked by `.agents/sow/pending/SOW-0010-20260602-static-analysis-finding-cleanu
 None yet.
 
 Append regression entries here only after this SOW was completed or closed and later testing or use found broken behavior. Use a dated `## Regression - YYYY-MM-DD` heading at the end of the file. Never prepend regression content above the original SOW narrative.
+
+## Regression - 2026-06-02
+
+What broke:
+
+- First pushed GitHub run `26812274331` failed in `.github/workflows/supply-chain-security.yml`.
+- OSV-Scanner job failed during tool installation because `github.com/google/osv-scanner/v2@v2.3.8` requires Go `>=1.26.2`, while the workflow installed Go `1.25.10` from `src/go/go.mod`.
+- OpenSSF Scorecard job failed while publishing results because Scorecard rejects workflows with global `security-events: write`; the workflow had that permission at top level.
+- First pushed GitHub run `26812274378` failed in `.github/workflows/codeql.yml`.
+- Rust CodeQL failed because Rust does not support manual build mode.
+- C/C++ CodeQL failed because the workflow built every CMake target and hit an existing GCC preprocessor issue in `tests/fixtures/c/test_stress.c:840`.
+- First pushed final Static Analysis run `26812569114` failed in the C Static Analysis job because it also built every CMake target before running library-scoped analyzers.
+- First pushed Runtime Safety run `26812274325` remained in progress with the Valgrind job running long after ASAN/UBSAN, TSAN, and Go race had completed.
+
+Evidence:
+
+- `gh run view 26812274331 --repo netdata/plugin-ipc --json jobs` showed `OSV-Scanner` and `OpenSSF Scorecard` failed while `Semgrep CE` succeeded.
+- `gh run view 26812274331 --repo netdata/plugin-ipc --log-failed` showed `requires go >= 1.26.2 (running go 1.25.10; GOTOOLCHAIN=local)`.
+- The same log showed Scorecard publish failed with `global perm is set to write: permission for security-events is set to write`.
+- `gh run view 26812274378 --repo netdata/plugin-ipc --json jobs` showed `Analyze Rust` and `Analyze C/C++` failed while `Analyze Go` succeeded.
+- The CodeQL Rust log showed `Rust does not support the manual build mode. Please try using one of the following build modes instead: none`.
+- The CodeQL C/C++ log showed `tests/fixtures/c/test_stress.c:840:46: error: missing binary operator before token "("`.
+- `gh run view 26812569114 --repo netdata/plugin-ipc --json jobs` showed `C Static Analysis` failed at `Build C targets`, while Go and workflow/shell jobs completed successfully.
+- `gh run view 26812274325 --repo netdata/plugin-ipc --json jobs` showed ASAN/UBSAN, TSAN, and Go race succeeded, while Valgrind stayed `in_progress`.
+- The Runtime Safety run metadata showed `updatedAt` remained near job start, and GitHub would not expose in-progress Valgrind logs.
+
+Why previous validation missed it:
+
+- Local OSV ran under the workstation Go toolchain, which is newer than the SDK module `go.mod` version used by `actions/setup-go`.
+- Local `actionlint` verifies workflow syntax but cannot validate Scorecard's runtime publishing restrictions.
+- Local CodeQL was not run; `actionlint` cannot validate per-language CodeQL build-mode restrictions.
+- Local full CMake used the workstation compiler environment, while the GitHub C/C++ CodeQL job used the hosted runner compiler path and built all tests.
+- The Static Analysis C job had the same over-broad build step as the original CodeQL C/C++ job.
+- The Runtime Safety workflow had no job timeout and ran the expensive Valgrind path on push and pull request events.
+
+Repair plan:
+
+1. Use Go `1.26.x` only for the OSV-Scanner tool job.
+2. Keep top-level workflow permissions read-only and move `security-events: write` to SARIF-uploading jobs.
+3. Use CodeQL `build-mode: none` for Rust.
+4. Limit C/C++ CodeQL manual build to the C library targets.
+5. Limit Static Analysis C build to the C library targets before running library-scoped analyzers.
+6. Keep Valgrind scheduled/manual with a bounded timeout; keep ASAN/UBSAN, TSAN, and Go race on push and pull request.
+7. Re-run YAML parse, `actionlint`, C library target build, SOW audit, and `git diff --check`.
+8. Commit and push the repair, then inspect the new GitHub run.
+
+Validation:
+
+- `ruby -e 'require "yaml"; Dir[".github/**/*.yml"].sort.each { |f| YAML.load_file(f) }; YAML.load_file(".clang-tidy")'` passed after the repair.
+- `/home/costa/.local/bin/actionlint` passed after the repair.
+- `/home/costa/.local/bin/osv-scanner scan --recursive --format sarif --output-file /tmp/plugin-ipc-osv.sarif .` passed and produced SARIF `2.1.0`.
+- `bash .agents/sow/audit.sh` passed with this SOW reopened in `current/`.
+- `git diff --check` passed.
+- CodeQL repair validation passed: YAML parsing, `actionlint`, local CMake build of `netipc_protocol`, `netipc_uds`, `netipc_shm`, and `netipc_service`, SOW audit, and `git diff --check`.
+- Static Analysis C repair validation passed: YAML parsing, `actionlint`, local CMake build of `netipc_protocol`, `netipc_uds`, `netipc_shm`, and `netipc_service`, scoped `clang-tidy`, `cppcheck`, `flawfinder`, SOW audit, and `git diff --check`.
+- Runtime Safety Valgrind gating validation passed: YAML parsing, `actionlint`, SOW audit, and `git diff --check`.
+
+Artifact updates:
+
+- Updated `.github/workflows/supply-chain-security.yml`, `.github/workflows/codeql.yml`, `.github/workflows/static-analysis.yml`, and `.github/workflows/runtime-safety.yml`.
+- No specs, public docs, or project skills changed because the repair is CI configuration only.