[jtroup]

ENG-9334

what

Pin uv 0.13.4 in .tool-versions. CI reads its uv version from this
file. The action's uv install step sets no version, so it gets the
latest uv and needs no change.

Bump the default sinistral-cli version to v0.5.39.1.

why

The eMudhra CA compromise needs uv 0.13.4 or later. The epic
ENG-9331 has the detail.

uv only covers our dev tooling. The action installs sinistral-cli at
scan time, so its runtime dependencies need the fix too.
sinistral-cli v0.5.39.1 upgrades certifi to 2026.10.19 for
GHSA-6q48-6c7w-9gw2.

testing

The lockfile needs no changes under uv 0.13.4, and we rely on CI to
run the suite under the new version.

docs

No docs needed.

---

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant CI as CI Pipeline
    participant Action as GitHub Action
    participant Runtime as Scan Runtime
    participant CLI as sinistral-cli
    participant Scanner as IaC Scanner

    Note over Dev,Scanner: Dependency Architecture for eMudhra CA Compromise Fix

    Dev->>Dev: Local development with uv 0.13.4
    Dev->>CI: Commit .tool-versions (uv 0.13.4)

    CI->>Action: Read .tool-versions for uv version
    Action->>Action: Install uv 0.13.4
    Action->>Action: Run CI test suite with pinned uv

    Note over Action,Scanner: Runtime Scan Flow
    Action->>Action: Read sinistral_cli_version input (default v0.5.39.1)
    Action->>Runtime: Install sinistral-cli v0.5.39.1
    Runtime->>Runtime: Resolve dependencies (certifi 2026.10.19)
    Runtime->>CLI: Execute sinistral-cli scan
    CLI->>Scanner: Scan IaC directories for policy violations
    Scanner-->>CLI: Scan results
    CLI-->>Runtime: Return results
    Runtime-->>Action: Post results as PR comment

Loading

_{Re-trigger cubic}