From d15c31477a9651793f973b2b1d64e57142e4c5a2 Mon Sep 17 00:00:00 2001
From: Haksung Jang <haksung@sk.com>
Date: Thu, 3 Sep 2026 11:18:11 +0900
Subject: [PATCH] Wire vulnerability/KEV/malicious/reachability/gate env vars
 into compose

21 vars documented in .env.example (KEV catalog refresh, malicious-package
snapshot, reachability analysis, build gate thresholds, vulnerability
re-match tuning, SLA alerting/day thresholds) were never referenced in
x-backend-env, so setting them in .env had no effect on the running
container. Adds them with defaults matching core/config.py exactly.

Part of the compose env-var wiring audit.
---
 docker-compose.dev.yml | 27 +++++++++++++++++++++++++++
 docker-compose.yml     | 27 +++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index b14b178..699a77a 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -174,6 +174,33 @@ x-backend-env: &backend-env
   GITHUB_TOKEN: ${GITHUB_TOKEN:-}
   TRUSTEDOSS_GITHUB_TOKEN: ${TRUSTEDOSS_GITHUB_TOKEN:-}
   PORTAL_PUBLIC_URL: ${PORTAL_PUBLIC_URL:-}
+  # compose-env-var wiring audit: vulnerability matching (KEV catalog,
+  # malicious-package snapshot, reachability analysis), the license/malicious
+  # build gate, and vulnerability SLA alerting. Documented in .env.example but
+  # never listed in this anchor, so setting any of them in .env had no effect
+  # on the running container. Defaults match core/config.py exactly, so an
+  # unset .env changes nothing for an existing deployment.
+  GATE_EPSS_THRESHOLD: ${GATE_EPSS_THRESHOLD:-}
+  GATE_MALICIOUS_ENABLED: ${GATE_MALICIOUS_ENABLED:-true}
+  GATE_REACHABLE_CRITICAL_ONLY: ${GATE_REACHABLE_CRITICAL_ONLY:-}
+  KEV_FEED_URL: ${KEV_FEED_URL:-https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json}
+  KEV_REFRESH_ENABLED: ${KEV_REFRESH_ENABLED:-true}
+  KEV_REFRESH_TIMEOUT_SECONDS: ${KEV_REFRESH_TIMEOUT_SECONDS:-30}
+  MALICIOUS_ENABLED: ${MALICIOUS_ENABLED:-true}
+  MALICIOUS_REFRESH_ENABLED: ${MALICIOUS_REFRESH_ENABLED:-}
+  MALICIOUS_SNAPSHOT_STALE_DAYS: ${MALICIOUS_SNAPSHOT_STALE_DAYS:-}
+  MALICIOUS_WAIVE_MAX_DAYS: ${MALICIOUS_WAIVE_MAX_DAYS:-30}
+  REACHABILITY_ENABLED: ${REACHABILITY_ENABLED:-true}
+  REACHABILITY_HARD_TIME_LIMIT_SECONDS: ${REACHABILITY_HARD_TIME_LIMIT_SECONDS:-1200}
+  REACHABILITY_SOFT_TIME_LIMIT_SECONDS: ${REACHABILITY_SOFT_TIME_LIMIT_SECONDS:-900}
+  VULN_REMATCH_BATCH_SIZE: ${VULN_REMATCH_BATCH_SIZE:-50}
+  VULN_REMATCH_INTERVAL_HOURS: ${VULN_REMATCH_INTERVAL_HOURS:-6}
+  VULN_REMATCH_LOCK_SKEW_SECONDS: ${VULN_REMATCH_LOCK_SKEW_SECONDS:-30}
+  VULN_SLA_ALERTS_ENABLED: ${VULN_SLA_ALERTS_ENABLED:-true}
+  VULN_SLA_DAYS_CRITICAL: ${VULN_SLA_DAYS_CRITICAL:-7}
+  VULN_SLA_DAYS_HIGH: ${VULN_SLA_DAYS_HIGH:-30}
+  VULN_SLA_DAYS_MEDIUM: ${VULN_SLA_DAYS_MEDIUM:-90}
+  VULN_SLA_DAYS_LOW: ${VULN_SLA_DAYS_LOW:-180}
 
 services:
   postgres:
diff --git a/docker-compose.yml b/docker-compose.yml
index 09a4cd1..da31b5f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -262,6 +262,33 @@ x-backend-env: &backend-env
   GITHUB_TOKEN: ${GITHUB_TOKEN:-}
   TRUSTEDOSS_GITHUB_TOKEN: ${TRUSTEDOSS_GITHUB_TOKEN:-}
   PORTAL_PUBLIC_URL: ${PORTAL_PUBLIC_URL:-}
+  # compose-env-var wiring audit: vulnerability matching (KEV catalog,
+  # malicious-package snapshot, reachability analysis), the license/malicious
+  # build gate, and vulnerability SLA alerting. Documented in .env.example but
+  # never listed in this anchor, so setting any of them in .env had no effect
+  # on the running container. Defaults match core/config.py exactly, so an
+  # unset .env changes nothing for an existing deployment.
+  GATE_EPSS_THRESHOLD: ${GATE_EPSS_THRESHOLD:-}
+  GATE_MALICIOUS_ENABLED: ${GATE_MALICIOUS_ENABLED:-true}
+  GATE_REACHABLE_CRITICAL_ONLY: ${GATE_REACHABLE_CRITICAL_ONLY:-}
+  KEV_FEED_URL: ${KEV_FEED_URL:-https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json}
+  KEV_REFRESH_ENABLED: ${KEV_REFRESH_ENABLED:-true}
+  KEV_REFRESH_TIMEOUT_SECONDS: ${KEV_REFRESH_TIMEOUT_SECONDS:-30}
+  MALICIOUS_ENABLED: ${MALICIOUS_ENABLED:-true}
+  MALICIOUS_REFRESH_ENABLED: ${MALICIOUS_REFRESH_ENABLED:-}
+  MALICIOUS_SNAPSHOT_STALE_DAYS: ${MALICIOUS_SNAPSHOT_STALE_DAYS:-}
+  MALICIOUS_WAIVE_MAX_DAYS: ${MALICIOUS_WAIVE_MAX_DAYS:-30}
+  REACHABILITY_ENABLED: ${REACHABILITY_ENABLED:-true}
+  REACHABILITY_HARD_TIME_LIMIT_SECONDS: ${REACHABILITY_HARD_TIME_LIMIT_SECONDS:-1200}
+  REACHABILITY_SOFT_TIME_LIMIT_SECONDS: ${REACHABILITY_SOFT_TIME_LIMIT_SECONDS:-900}
+  VULN_REMATCH_BATCH_SIZE: ${VULN_REMATCH_BATCH_SIZE:-50}
+  VULN_REMATCH_INTERVAL_HOURS: ${VULN_REMATCH_INTERVAL_HOURS:-6}
+  VULN_REMATCH_LOCK_SKEW_SECONDS: ${VULN_REMATCH_LOCK_SKEW_SECONDS:-30}
+  VULN_SLA_ALERTS_ENABLED: ${VULN_SLA_ALERTS_ENABLED:-true}
+  VULN_SLA_DAYS_CRITICAL: ${VULN_SLA_DAYS_CRITICAL:-7}
+  VULN_SLA_DAYS_HIGH: ${VULN_SLA_DAYS_HIGH:-30}
+  VULN_SLA_DAYS_MEDIUM: ${VULN_SLA_DAYS_MEDIUM:-90}
+  VULN_SLA_DAYS_LOW: ${VULN_SLA_DAYS_LOW:-180}
 
 services:
   # ---------------------------------------------------------------------------