k.rennerandClaude Opus 4.7
2d3cd7a819
Pipeline 850 reproduced two distinct failures: 1. image-scans died — Apache Tika hit Trivy's default 5-minute `context deadline exceeded`, and goauthentik/server's 30MB msgraph kiota-dom-export.txt blew the secret scanner's memory budget (Trivy itself warned about it). 2. security-fix-agent was skipped despite `failure: ignore` on image-scans. Woodpecker's `failure: ignore` only affects *workflow* status — downstream steps still gate on the previous step's exit, defaulting to status: [success]. Fixes: - `--timeout 15m` and `--scanners vuln` on per-image trivy calls. We only care about CVEs (CRITICAL/HIGH, with FixedVersion) — the secret scanner was the OOM culprit and adds no value for our agent's decision rules. - `when: status: [success, failure]` on security-fix-agent so it always runs, regardless of which scans crashed. The step's own gating logic already handles missing/empty JSON files. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>