- Add validation_context with trusted CA to all upstream TLS clusters in the Envoy template, fixing 503 errors in environments with TLS-intercepting proxies
- Increase default connect_timeout from 0.5s to 5s for upstream provider clusters to avoid failures behind VPNs/proxies (internal clusters stay at 0.5s)
- Add upstream_connect_timeout and upstream_tls_ca_path overrides in plano_config.yaml for user customization
- Fix missing common_tls_context on the Mistral cluster
* Add Trivy Docker image security scan workflow
Scans the Docker image for CRITICAL and HIGH vulnerabilities using Trivy.
Blocks PRs on failures; runs non-blocking on main for visibility. Results
are uploaded to the GitHub Security tab via SARIF.
* Add explicit permissions to Docker security scan workflow
Set minimal permissions: contents read for checkout, security-events
write for SARIF upload to the GitHub Security tab.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix 27 HIGH vulnerabilities found by Trivy Docker scan
- Install supervisor via pip instead of apt to eliminate 22 Debian
python3.13 package vulnerabilities
- Pin urllib3>=2.6.3 to fix CVE-2025-66418, CVE-2025-66471, CVE-2026-21441
- Add ignore-unfixed to Trivy scan to suppress unfixable glibc CVE-2026-0861
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
