atlan-application-sdk 2.3.0__tar.gz → 2.3.2__tar.gz

atlan_application_sdk-2.3.2/.cursor/rules/build-security.mdc

@@ -0,0 +1,35 @@
+# Build & Security Scanning
+
+This rule is triggered when working with Docker images, security scanning (Trivy/Grype/Snyk), Dapr configuration, or CI/CD pipelines.
+
+> **IMPORTANT**: Always run security scans after Dockerfile changes or dependency updates. CI will block HIGH/CRITICAL vulnerabilities.
+
+## Quick Reference
+
+- **Image base**: `cgr.dev/chainguard-private/python` → golden images → SDK → apps
+- **Dapr runtime**: Installed via Chainguard APK (0 CVEs), configured in Dockerfile
+- **Registries**: Harbor (`registry.atlan.com`) for production, GHCR for CI
+
+## Build & Scan Commands
+
+```bash
+# Build image locally
+docker build -t application-sdk:local .
+
+# Scan image
+trivy image application-sdk:local
+grype application-sdk:local
+
+# Scan dependencies
+trivy fs uv.lock
+snyk test --file=requirements.txt  # requires: uv export --frozen --no-hashes --no-header -o requirements.txt
+```
+
+## For Full Details
+
+Read `docs/build-scan-overview.md` for:
+- Complete image hierarchy and layer details
+- Publishing triggers and tag conventions
+- Dapr Dockerfile configuration
+- CI/CD workflow matrix
+- Snyk/uv.lock workaround

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.cursor/rules/commits.mdc

@@ -114,6 +114,7 @@ This reverts commit abc123def456.
 - **Reference issues**: Link commits to relevant GitHub issues when applicable
 - **Test before committing**: Ensure all tests pass before creating a commit
 - **Review the diff**: Always review your changes before committing
+- **Scan before pushing**: For Dockerfile or dependency changes, run security scans before pushing (see [build-security.mdc](mdc:.cursor/rules/build-security.mdc))
 
 ## Tools
 

atlan_application_sdk-2.3.2/.cursor/rules/deepwiki.mdc

@@ -0,0 +1,53 @@
+---
+description: SDK development rules using DeepWiki MCP for verification
+globs:
+alwaysApply: true
+---
+# SDK Development with DeepWiki MCP
+
+DeepWiki MCP provides AI-powered documentation and search for public GitHub repositories.
+
+## Available Tools
+
+- read_wiki_structure: Get documentation topics for a repository
+- read_wiki_contents: View repository documentation
+- ask_question: Ask questions about a repository (AI-powered, context-grounded)
+
+## Core Rule: Always Verify with DeepWiki
+
+Never assume SDK implementation details for:
+- atlanhq/atlan-python
+- atlanhq/application-sdk
+
+Always use DeepWiki MCP tools to verify against actual source code and documentation.
+
+## Workflow
+
+1. Use ask_question for specific implementation questions
+2. Use read_wiki_structure to understand available documentation
+3. Use read_wiki_contents to read detailed documentation
+4. Provide answers based on verified information
+
+## When to Use DeepWiki
+
+Use for:
+- SDK API usage and method signatures
+- Error debugging
+- Implementation patterns
+- Parameter types and return values
+- Usage examples from actual code
+
+## Examples
+
+Instead of guessing:
+"How does application-sdk handle authentication?" -> ask_question tool
+"What methods are available in atlan-java Client class?" -> ask_question tool
+"Show me the structure of atlan-python docs" -> read_wiki_structure tool
+
+## Response Format
+
+When using DeepWiki findings:
+- Reference the repository queried
+- Include specific method/class names found
+- Provide code examples when available
+- Link to relevant documentation sections

atlan_application_sdk-2.3.2/.cursor/rules/documentation.mdc

@@ -0,0 +1,20 @@
+---
+description: Update conceptual documentation when SDK code changes to keep docs synchronized with implementation
+globs: application_sdk/**/*.py
+alwaysApply: false
+---
+# Documentation Updates
+
+When modifying SDK code, update corresponding conceptual documentation under `docs/concepts/` to reflect changes.
+
+**Module to Concept Doc Mapping:**
+*   `application_sdk/application/**` -> `docs/concepts/application.md`
+*   `application_sdk/server/**` -> `docs/concepts/server.md`
+*   `application_sdk/handlers/**` -> `docs/concepts/handlers.md`
+*   `application_sdk/clients/**` -> `docs/concepts/clients.md`
+*   `application_sdk/activities/**` -> `docs/concepts/activities.md`
+*   `application_sdk/common/**` or `application_sdk/constants.py` -> `docs/concepts/common.md`
+*   `application_sdk/io/**` -> `docs/concepts/inputs.md` (for readers) AND `docs/concepts/outputs.md` (for writers)
+*   `application_sdk/transformers/**` -> `docs/concepts/transformers.md`
+*   `application_sdk/workflows/**` -> `docs/concepts/workflows.md`
+*   `application_sdk/worker.py` -> `docs/concepts/worker.md`

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.cursor/rules/setup.mdc

@@ -17,13 +17,12 @@ The Atlan Python Application SDK requires the following components regardless of
 
 Please follow the appropriate guide for your operating system:
 
-- [MAC.md](mdc:docs/docs/setup/MAC.md)
-- [LINUX.md](mdc:docs/docs/setup/LINUX.md)
-- [WINDOWS.md](mdc:docs/docs/setup/WINDOWS.md)
+- [MAC.md](mdc:docs/setup/MAC.md)
+- [LINUX.md](mdc:docs/setup/LINUX.md)
+- [WINDOWS.md](mdc:docs/setup/WINDOWS.md)
 
-Once the development environment is setup follow the [getting-started.md](mdc:docs/docs/guides/getting-started.md) to setup project dependencies and run an example
+Once the development environment is setup follow the [getting-started.md](mdc:docs/guides/getting-started.md) to setup project dependencies and run an example
 
 ## Need Help?
 
 If you encounter any issues during setup, please reach out to us at connect@atlan.com.
-

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.cursor/rules/standards.mdc

@@ -24,8 +24,8 @@ This document outlines the development standards for the Application SDK, includ
     - Use Google-style docstrings
     - Include type information in docstrings
     - Document all public APIs
-    - Build docs using `uv sync --all-extras --all-groups && uv run poe generate-apidocs`
-    - Docs must go under ./docs/docs
+    - Build docs using `uv sync --group docs --all-extras && uv run poe generate-apidocs`
+    - Docs must go under ./docs
 
 - **Single Responsibility**
     - Each function should do exactly one thing

atlan_application_sdk-2.3.2/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @stefan-atlan @cmgrote @OnkarVO7

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.github/actions/secure-build-push-apps/action.yaml

@@ -310,7 +310,7 @@ runs:
 
     - name: Run Trivy Scan
       id: trivy_scan
-      uses: aquasecurity/trivy-action@0.24.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         # UPDATED: Use the single, primary tag from the step above
         image-ref: ${{ steps.extract_tag.outputs.primary_tag }}
@@ -549,4 +549,4 @@ runs:
         else
           echo "❌ Failed to start import job. HTTP Code: $HTTP_CODE"
           exit 1
-        fi
+        fi

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.github/actions/trivy/action.yaml

@@ -18,7 +18,7 @@ runs:
 
 
     - name: Trivy Vulnerability Scan (SARIF)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'sarif'
@@ -31,7 +31,7 @@ runs:
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Trivy Vulnerability Scan (JSON)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'json'
@@ -44,7 +44,7 @@ runs:
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Trivy Secret Scan (SARIF)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'sarif'
@@ -57,7 +57,7 @@ runs:
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Trivy Secret Scan (JSON)
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'json'
@@ -119,22 +119,23 @@ runs:
         message-id: trivy-secret
         message-path: trivy-secret-results.md
 
-    - name: Fail on High/Critical Vulnerabilities
+    - name: Fail on High/Critical Vulnerabilities (with fix available)
       if: inputs.add-report-comment-to-pr == 'true'
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'table'
         severity: 'CRITICAL,HIGH'
         exit-code: '1'
         scanners: 'vuln'
+        ignore-unfixed: true
       env:
         TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
 
     - name: Fail on Any Secrets Found
       if: inputs.add-report-comment-to-pr == 'true'
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@0.33.1
       with:
         scan-type: 'fs'
         format: 'table'

atlan_application_sdk-2.3.2/.github/actions/trivy-container/action.yaml

@@ -0,0 +1,107 @@
+name: Trivy Container Scan for Atlan Apps
+
+description: |
+  Runs Trivy security scanner on container images to detect and report vulnerabilities.
+  Builds the Docker image with Chainguard base image authentication and scans it.
+  Results are uploaded to the GitHub Security tab.
+
+inputs:
+  chainguard-username:
+    description: Chainguard registry username
+    required: true
+  chainguard-password:
+    description: Chainguard registry password
+    required: true
+  github-token:
+    description: GitHub token for Docker build secrets
+    required: true
+  fail-on-vulns:
+    description: Whether to fail if HIGH/CRITICAL vulnerabilities with fixes are found
+    required: false
+    default: 'false'
+  skip-files:
+    description: Comma-separated list of files or directories to be skipped
+    required: false
+
+outputs:
+  results-file:
+    description: Path to the JSON results file
+    value: ${{ steps.scan.outputs.results-file }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Log in to Chainguard Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: cgr.dev
+        username: ${{ inputs.chainguard-username }}
+        password: ${{ inputs.chainguard-password }}
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile
+        push: false
+        load: true
+        tags: trivy-scan-target:latest
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        secrets: |
+          "PRIVATE_REPO_ACCESS_TOKEN=${{ inputs.github-token }}"
+
+    - name: Run Trivy scan (JSON)
+      id: scan
+      uses: aquasecurity/trivy-action@0.33.1
+      with:
+        image-ref: 'trivy-scan-target:latest'
+        format: 'json'
+        output: 'trivy-container-results.json'
+        severity: 'CRITICAL,HIGH'
+        scanners: 'vuln'
+      env:
+        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
+
+    - name: Set results file output
+      shell: bash
+      run: echo "results-file=trivy-container-results.json" >> $GITHUB_OUTPUT
+
+    - name: Run Trivy scan (SARIF)
+      uses: aquasecurity/trivy-action@0.33.1
+      with:
+        image-ref: 'trivy-scan-target:latest'
+        format: 'sarif'
+        output: 'trivy-container-results.sarif'
+        severity: 'CRITICAL,HIGH'
+        scanners: 'vuln'
+        skip-files: ${{ inputs.skip-files }}
+      env:
+        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
+
+    - name: Upload scan results to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v3
+      if: always()
+      continue-on-error: true
+      with:
+        sarif_file: 'trivy-container-results.sarif'
+        category: 'trivy-container'
+
+    - name: Fail on HIGH/CRITICAL vulnerabilities (with fix available)
+      if: inputs.fail-on-vulns == 'true'
+      uses: aquasecurity/trivy-action@0.33.1
+      with:
+        image-ref: 'trivy-scan-target:latest'
+        format: 'table'
+        severity: 'CRITICAL,HIGH'
+        exit-code: '1'
+        scanners: 'vuln'
+        ignore-unfixed: true
+      env:
+        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1

atlan_application_sdk-2.3.2/.github/dependabot.yaml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      python-deps:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly

atlan_application_sdk-2.3.2/.github/release_notes.md

@@ -0,0 +1,9 @@
+## v2.3.2 (February 04, 2026)
+
+Full Changelog: https://github.com/atlanhq/application-sdk/compare/v2.3.1...v2.3.2
+
+### Bug Fixes
+
+- update codeowner (#954) (by @OnkarVO7 in [3a29977](https://github.com/atlanhq/application-sdk/commit/3a29977))
+- align daft writer behavior with pandas to prevent data loss (BLDX-305) (#953) (by @fyzanshaik-atlan in [1a73d02](https://github.com/atlanhq/application-sdk/commit/1a73d02))
+- tune dependabot settings to reduce noise (#1008) (by @fyzanshaik-atlan in [50e09ac](https://github.com/atlanhq/application-sdk/commit/50e09ac))

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.github/workflows/build-image.yaml

@@ -1,11 +1,13 @@
 name: Application SDK Docker Image
 
 on:
+  workflow_dispatch:  # Allow manual triggering
   push:
     branches:
       - main
     paths:
       - 'Dockerfile'
+      - 'entrypoint.sh'
 
 permissions:
   contents: read
@@ -95,4 +97,4 @@ jobs:
           github-token: ${{ secrets.ORG_PAT_GITHUB }}
         env:
           DOCKER_CLIENT_TIMEOUT: 600
-          COMPOSE_HTTP_TIMEOUT: 600
+          COMPOSE_HTTP_TIMEOUT: 600

atlan_application_sdk-2.3.2/.github/workflows/harbor-release.yaml

@@ -0,0 +1,74 @@
+name: Publish Harbor Image (Release)
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  push-to-harbor:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}-harbor
+      cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Set up Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Get SDK version
+        id: get_version
+        run: echo "version=$(awk -F'"' '/^version = / {print $2}' pyproject.toml)" >> $GITHUB_OUTPUT
+
+      - name: Get short commit SHA
+        id: get_sha
+        run: echo "sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+
+      - name: Log in to Atlan Harbor Registry
+        uses: docker/login-action@v3
+        with:
+          registry: registry.atlan.com
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
+
+      - name: Log in to Chainguard Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: cgr.dev
+          username: ${{ secrets.CHAINGUARD_USERNAME }}
+          password: ${{ secrets.CHAINGUARD_PASSWORD }}
+
+      - name: Build, scan, and push image to Harbor
+        id: harbor_docker_build
+        uses: ./.github/actions/secure-build-push-apps
+        with:
+          branch: main
+          snyk-token: ${{ secrets.SNYK_TOKEN_BU_APPS }}
+          snyk-ghcr-integration-id: ${{ secrets.SNYK_GHCR_INTEGRATION_ID }}
+          snyk-docker-integration-id: ${{ secrets.SNYK_DOCKER_INTEGRATION_ID }}
+          snyk-integration-id: ${{ secrets.SNYK_INTEGRATION_ID }}
+          snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            registry.atlan.com/public/application-sdk:main-latest
+            registry.atlan.com/public/application-sdk:main-${{ steps.get_version.outputs.version }}
+            registry.atlan.com/public/application-sdk:sha-${{ steps.get_sha.outputs.sha }}
+          build-args: |
+            ACCESS_TOKEN_USR=$GITHUB_ACTOR
+            ACCESS_TOKEN_PWD=${{ secrets.ORG_PAT_GITHUB }}
+          github-token: ${{ secrets.ORG_PAT_GITHUB }}
+        env:
+          DOCKER_CLIENT_TIMEOUT: 600
+          COMPOSE_HTTP_TIMEOUT: 600

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.github/workflows/pull_request.yaml

@@ -14,6 +14,22 @@ permissions:
   actions: write
 
 jobs:
+  # Detect which files changed
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      container: ${{ steps.filter.outputs.container }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            container:
+              - 'Dockerfile'
+              - 'entrypoint.sh'
+
   # Conventional Commits
   commits:
     name: Conventional Commits
@@ -46,6 +62,20 @@ jobs:
         with:
           add-report-comment-to-pr: "true"
 
+  trivy-container:
+    name: Trivy Container Scan
+    needs: changes
+    if: needs.changes.outputs.container == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: "./.github/actions/trivy-container"
+        with:
+          chainguard-username: ${{ secrets.CHAINGUARD_USERNAME }}
+          chainguard-password: ${{ secrets.CHAINGUARD_PASSWORD }}
+          github-token: ${{ secrets.ORG_PAT_GITHUB }}
+          fail-on-vulns: 'true'
+
   # Testing
   unit:
     name: Unit Tests
@@ -200,7 +230,7 @@ jobs:
 
       - name: Upload Docs to Kryptonite Bucket
         run: |
-          aws s3 sync ./docs/site s3://kryptonite-store/application-sdk/${{ github.head_ref }} --delete
+          aws s3 sync ./site s3://kryptonite-store/application-sdk/${{ github.head_ref }} --delete
 
       - name: Comment Kryptonite URL on PR
         uses: mshick/add-pr-comment@v2

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.github/workflows/push.yaml

@@ -78,4 +78,4 @@ jobs:
 
       - name: Upload Docs to Kryptonite Bucket
         run: |
-          aws s3 sync ./docs/site s3://kryptonite-store/application-sdk/${{ github.head_ref }} --delete
+          aws s3 sync ./site s3://kryptonite-store/application-sdk/${{ github.head_ref }} --delete

atlan_application_sdk-2.3.2/.github/workflows/scheduled-vulnerability-scan.yaml

@@ -0,0 +1,122 @@
+name: Scheduled Vulnerability Scan
+
+on:
+  schedule:
+    # Run every Monday at 9 AM UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch: # Allow manual trigger
+
+permissions:
+  contents: read
+  issues: write
+  security-events: write
+
+jobs:
+  scan-base-image:
+    name: Scan SDK Base Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Run container vulnerability scan
+        id: scan
+        uses: "./.github/actions/trivy-container"
+        with:
+          chainguard-username: ${{ secrets.CHAINGUARD_USERNAME }}
+          chainguard-password: ${{ secrets.CHAINGUARD_PASSWORD }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fail-on-vulns: 'false'
+
+      - name: Check for daprd vulnerabilities
+        id: check-daprd
+        run: |
+          # Extract vulnerabilities specifically from daprd binary
+          DAPRD_VULNS=$(cat trivy-container-results.json | jq -r '
+            .Results[]
+            | select(.Target | contains("daprd"))
+            | .Vulnerabilities // []
+            | length
+          ' | awk '{s+=$1} END {print s+0}')
+
+          echo "daprd_vulns=$DAPRD_VULNS" >> $GITHUB_OUTPUT
+
+          if [ "$DAPRD_VULNS" -gt 0 ]; then
+            echo "::warning::Found $DAPRD_VULNS vulnerabilities in daprd runtime!"
+            echo "has_daprd_vulns=true" >> $GITHUB_OUTPUT
+          else
+            echo "daprd runtime is clean (0 vulnerabilities)"
+            echo "has_daprd_vulns=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Check for CLI vulnerabilities
+        id: check-cli
+        run: |
+          # Extract vulnerabilities from dapr CLI
+          CLI_VULNS=$(cat trivy-container-results.json | jq -r '
+            .Results[]
+            | select(.Target | contains("usr/local/bin/dapr"))
+            | .Vulnerabilities // []
+            | length
+          ' | awk '{s+=$1} END {print s+0}')
+
+          echo "cli_vulns=$CLI_VULNS" >> $GITHUB_OUTPUT
+          echo "Found $CLI_VULNS HIGH/CRITICAL vulnerabilities in dapr CLI"
+
+      - name: Generate scan summary
+        run: |
+          echo "## Vulnerability Scan Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Component | HIGH/CRITICAL Vulns | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|-----------|---------------------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "| daprd (runtime) | ${{ steps.check-daprd.outputs.daprd_vulns }} | ${{ steps.check-daprd.outputs.daprd_vulns == '0' && '✅ Clean' || '⚠️ Action Required' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| dapr CLI | ${{ steps.check-cli.outputs.cli_vulns }} | ℹ️ Upstream issue |" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Note:** CLI vulnerabilities are in unused code paths (Helm packages)." >> $GITHUB_STEP_SUMMARY
+
+      - name: Create issue if daprd has vulnerabilities
+        if: steps.check-daprd.outputs.has_daprd_vulns == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = '🚨 Security: Vulnerabilities detected in daprd runtime';
+            const body = `## Vulnerability Alert
+
+            The scheduled vulnerability scan has detected **HIGH/CRITICAL vulnerabilities** in the daprd runtime binary.
+
+            ### Details
+            - **Vulnerabilities found:** ${{ steps.check-daprd.outputs.daprd_vulns }}
+            - **Scan date:** ${new Date().toISOString().split('T')[0]}
+
+            ### Recommended Actions
+            1. Check if Chainguard has a patched version: \`apk search dapr\`
+            2. If available, update Dockerfile to use Chainguard APK
+            3. If not, contact Chainguard via their support channel
+
+            ### References
+            - [Chainguard DAPR packages](https://images.chainguard.dev/directory/image/dapr-daprd/compare)
+            - [DAPR releases](https://github.com/dapr/dapr/releases)
+
+            /cc @atlanhq/builder-experience
+            `;
+
+            // Check if similar issue already exists
+            const issues = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'security,daprd-vulnerability'
+            });
+
+            if (issues.data.length === 0) {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: title,
+                body: body,
+                labels: ['security', 'daprd-vulnerability', 'priority:high']
+              });
+              console.log('Created new security issue');
+            } else {
+              console.log('Security issue already exists, skipping creation');
+            }

{atlan_application_sdk-2.3.0 → atlan_application_sdk-2.3.2}/.github/workflows/trivy-container.yaml

@@ -7,12 +7,21 @@ on:
     secrets:
       ORG_PAT_GITHUB:
         required: true
+      CHAINGUARD_USERNAME:
+        required: true
+      CHAINGUARD_PASSWORD:
+        required: true
 
     inputs:
       skip-files:
         description: "Comma-separated list of files or directories to be skipped"
         required: false
         type: string
+      fail-on-vulns:
+        description: "Whether to fail if HIGH/CRITICAL vulnerabilities with fixes are found"
+        required: false
+        type: string
+        default: 'true'
 
 permissions:
   contents: read
@@ -29,4 +38,8 @@ jobs:
 
       - uses: "atlanhq/application-sdk/.github/actions/trivy-container@main"
         with:
+          chainguard-username: ${{ secrets.CHAINGUARD_USERNAME }}
+          chainguard-password: ${{ secrets.CHAINGUARD_PASSWORD }}
           github-token: ${{ secrets.ORG_PAT_GITHUB }}
+          skip-files: ${{ inputs.skip-files }}
+          fail-on-vulns: ${{ inputs.fail-on-vulns }}