ci(alerts): memory limits, trivy ignores

.trivyignore

@@ -0,0 +1,19 @@
+# KSV-0125: Restrict container images to trusted registries
+# Why ignored: The container image path is dynamically constructed using Helm templates 
+# (e.g., "{{- if and $c.registry ... }}") and defaults to ghcr.io. Trivy performs static 
+# analysis on raw templates before values are rendered, and flags the Go template syntax 
+# itself as an untrusted registry name.
+AVD-KSV-0125
+
+# KSV-0020 / KSV-0021: Runs with UID/GID <= 10000
+# Why ignored: OpenShift's Security Context Constraints (SCC) dynamically allocate 
+# extremely high range UIDs and GIDs (e.g., 1000600000+) at runtime. Hardcoding specific 
+# UIDs/GIDs like 10001 in these Helm templates to satisfy the static scanner will trigger 
+# admission webhook rejections on standard OpenShift namespaces.
+AVD-KSV-0020
+AVD-KSV-0021
+
+# KSV-0011: CPU not limited
+# Why ignored: Om, our smart coworker, advised removing CPU limits to allow containers 
+# to burst into unallocated node capacity, preventing unnecessary throttling during peak load.
+AVD-KSV-0011

charts/pubcode/values.yaml

@@ -46,6 +46,8 @@ api:
         requests:
           cpu: 50m
           memory: 100Mi
+        limits:
+          memory: 4Gi
       readinessProbe:
         httpGet:
           path: /api/pub-code/health
@@ -147,6 +149,8 @@ frontend:
         requests:
           cpu: 50m
           memory: 50Mi
+        limits:
+          memory: 4Gi
       readinessProbe:
         httpGet:
           path: /health
@@ -239,6 +243,8 @@ database:
         requests:
           cpu: 50m
           memory: 150Mi
+        limits:
+          memory: 4Gi
       volumeMounts:
         - name: '{{ .Release.Name }}-database'
           mountPath: /data/db
@@ -261,6 +267,8 @@ database:
         requests:
           cpu: 50m
           memory: 150Mi
+        limits:
+          memory: 4Gi
       readinessProbe:
         tcpSocket:
           port: 27017