v1.2.1

Author: CoderLuii

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -21,7 +21,7 @@ body:
     attributes:
       label: ChannelWatch version
       description: In Settings > Updates, copy Application version. Include Container image version if the problem involves updating.
-      placeholder: "e.g. 1.2.0"
+      placeholder: "e.g. 1.2.1"
     validations:
       required: true
 

.github/ISSUE_TEMPLATE/question.yml

@@ -28,7 +28,7 @@ body:
     attributes:
       label: ChannelWatch version
       description: In Settings > Updates, copy Application version. Include Container image version if the problem involves updating.
-      placeholder: "e.g. 1.2.0"
+      placeholder: "e.g. 1.2.1"
     validations:
       required: true
 

.github/workflows/docker-publish.yml

@@ -26,7 +26,7 @@ env:
   DOCKERHUB_IMAGE: coderluii/channelwatch
   GHCR_IMAGE: ghcr.io/coderluii/channelwatch
   DOCKER_PLATFORMS: linux/amd64,linux/arm64
-  SKOPEO_IMAGE: quay.io/skopeo/stable@sha256:8482f709108354691af2defec4cad5f3ddea6cfff0c8091109dec8034574a918 # v1.22.3
+  SKOPEO_IMAGE: quay.io/containers/skopeo:v1.22.3-immutable@sha256:f45eb1e14223a5ba0da4246274679a083653dab1402acc1fcb70a6339b50cf00 # v1.22.3
   RELEASE_TAG: ${{ github.ref_name }}
   RELEASE_SHA: ${{ github.sha }}
 
@@ -193,7 +193,7 @@ jobs:
           CHANNELWATCH_TRIVY_REPORT: ${{ runner.temp }}/channelwatch-trivy.json
         run: |
           trivy fs \
-            --scanners vuln,secret,misconfig \
+            --scanners secret,misconfig \
             --severity CRITICAL,HIGH \
             --ignore-unfixed \
             --exit-code 1 \
@@ -202,6 +202,24 @@ jobs:
             --format json \
             --output "${CHANNELWATCH_TRIVY_REPORT}" \
             .
+      - name: Report accepted upstream dependency vulnerabilities
+        run: |
+          trivy fs \
+            --scanners vuln \
+            --severity CRITICAL,HIGH,MEDIUM,LOW \
+            --exit-code 0 \
+            --format json \
+            --output "${RUNNER_TEMP}/channelwatch-upstream-dependencies.json" \
+            .
+          echo "Upstream dependency vulnerabilities are advisory; code, secret and configuration checks remain enforced."
+      - name: Retain upstream dependency report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: upstream-dependencies-${{ github.sha }}
+          path: ${{ runner.temp }}/channelwatch-upstream-dependencies.json
+          retention-days: 30
+          if-no-files-found: error
       - name: Scan the explicit Helm Secret mode
         env:
           CHANNELWATCH_TRIVY_SECRET_REPORT: ${{ runner.temp }}/channelwatch-trivy-secret.json
@@ -572,12 +590,28 @@ jobs:
             trivy image \
               --input "${RUNNER_TEMP}/channelwatch-candidate-one.oci" \
               --platform "${platform}" \
-              --scanners vuln,secret,misconfig \
+              --scanners vuln \
+              --severity CRITICAL,HIGH,MEDIUM,LOW \
+              --exit-code 0 \
+              --format json \
+              --output "${RUNNER_TEMP}/channelwatch-upstream-linux-${platform#linux/}.json"
+            trivy image \
+              --input "${RUNNER_TEMP}/channelwatch-candidate-one.oci" \
+              --platform "${platform}" \
+              --scanners secret,misconfig \
               --severity CRITICAL,HIGH \
-              --ignore-unfixed \
               --exit-code 1
           done
 
+      - name: Retain accepted upstream image vulnerabilities
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: upstream-image-candidate-${{ github.sha }}
+          path: ${{ runner.temp }}/channelwatch-upstream-linux-*.json
+          retention-days: 30
+          if-no-files-found: error
+
       - name: Verify pinned bridge or run v0.9.18 historical canaries
         shell: bash
         run: |
@@ -1417,12 +1451,28 @@ jobs:
             trivy image \
               --input "${OCI_LAYOUT}" \
               --platform "${platform}" \
-              --scanners vuln,secret,misconfig \
+              --scanners vuln \
+              --severity CRITICAL,HIGH,MEDIUM,LOW \
+              --exit-code 0 \
+              --format json \
+              --output "${RUNNER_TEMP}/channelwatch-upstream-linux-${platform#linux/}.json"
+            trivy image \
+              --input "${OCI_LAYOUT}" \
+              --platform "${platform}" \
+              --scanners secret,misconfig \
               --severity CRITICAL,HIGH \
-              --ignore-unfixed \
               --exit-code 1
           done
 
+      - name: Retain accepted upstream image vulnerabilities
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: upstream-image-release-${{ github.sha }}
+          path: ${{ runner.temp }}/channelwatch-upstream-linux-*.json
+          retention-days: 30
+          if-no-files-found: error
+
       - name: Install pinned Syft
         id: syft
         uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2

README.md

@@ -216,9 +216,9 @@ The Helm chart is single-replica by design because ChannelWatch uses writable ap
 
 ## Updating ChannelWatch
 
-Use `coderluii/channelwatch:1.2.0` for the current image milestone, or `latest` for the newest stable image. Preserve `/config` and any external storage key configuration when recreating the container.
+Use `coderluii/channelwatch:1.2.1` for the current release, or `latest` for the newest stable image. Preserve `/config` and any external storage key configuration when recreating the container.
 
-ChannelWatch v1.2.0 requires a container image update. Pull the new image and recreate the container with the same `/config` volume. It refreshes the container runtime and compatible dependencies while retaining the recording-alert fixes and Program image setting released in v1.1.3. **Settings > Updates** will identify this as an image update rather than installing it in-app.
+ChannelWatch v1.2.1 is a signed in-app update for the v1.2.0 image. Install it from **Settings > Updates** to keep scheduled recordings labeled correctly and collect a safe failure category if an update restart fails. If you are still on an older image line, pull the current image and recreate the container with the same `/config` volume first.
 
 Open **Settings > Updates** to review the automatic update policy, check the official signed stable channel, apply an update immediately, postpone it, retry a failed attempt, or roll back a compatible app bundle. Automatic compatible updates default to the local 03:00–05:00 maintenance window; notify-only mode is available.
 

app/core/__init__.py

@@ -7,7 +7,7 @@
 import os
 from pathlib import Path
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"
 __app_name__ = "ChannelWatch"
 
 

app/core/alerts/recording_events.py

@@ -2196,7 +2196,6 @@ async def run_cleanup(self) -> None:
                     break
                 scheduled_jobs_checked += 1
 
-                info = scheduled_snapshot[job_id]
                 is_active = True
                 try:
                     start_time = time.time()
@@ -2227,13 +2226,6 @@ async def run_cleanup(self) -> None:
                     stale_scheduled.append(job_id)
                     continue
 
-                if current_time - info.get("created_at", 0) > 86400:
-                    log(
-                        f"Scheduled job {job_id} was created over 24 hours ago, marking as stale",
-                        level=LOG_VERBOSE,
-                    )
-                    stale_scheduled.append(job_id)
-
             if stale_scheduled:
                 async with self._event_lock:
                     for job_id in stale_scheduled:

app/core/runtime_launcher.py

@@ -92,6 +92,24 @@
 PROTOCOL_THREE_STOP_BARRIER_INTERVAL_SECONDS = 0.05
 RUNTIME_CONTROL_MAX_BYTES = 256 * 1024
 RECOVERY_MODE_ENV = "CHANNELWATCH_OFFICIAL_RECOVERY_MODE"
+RESTART_FAILURE_DIAGNOSTICS = frozenset(
+    {
+        "restart_helper_spawn_failed",
+        "restart_helper_ack_timeout",
+        "restart_helper_rejected",
+        "restart_supervisor_unavailable",
+    }
+)
+
+
+class RestartRequestError(RuntimeError):
+    """A coordinated restart failure safe to expose as a category only."""
+
+    def __init__(self, diagnostic: str):
+        if diagnostic not in RESTART_FAILURE_DIAGNOSTICS:
+            raise ValueError("Unsupported restart failure diagnostic.")
+        self.diagnostic = diagnostic
+        super().__init__("Coordinated restart request failed.")
 
 
 def utc_now() -> str:
@@ -1814,7 +1832,7 @@ def _spawn_protocol_three_restart_helper() -> None:
     except Exception:
         os.close(read_fd)
         os.close(write_fd)
-        raise
+        raise RestartRequestError("restart_helper_spawn_failed") from None
     os.close(write_fd)
     try:
         ready, _, _ = select.select(
@@ -1823,8 +1841,10 @@ def _spawn_protocol_three_restart_helper() -> None:
         response = os.read(read_fd, 64) if ready else b""
     finally:
         os.close(read_fd)
+    if not ready:
+        raise RestartRequestError("restart_helper_ack_timeout")
     if response != b"ready\n":
-        raise RuntimeError("Image-owned Supervisor restart helper was not accepted.")
+        raise RestartRequestError("restart_helper_rejected")
 
 
 def request_container_restart() -> None:
@@ -1841,10 +1861,11 @@ def request_container_restart() -> None:
 
     supervisor_pid = _supervisor_parent_pid()
     if supervisor_pid is None:
-        raise RuntimeError(
-            "Coordinated container restart requires supervisord as the direct parent."
-        )
-    os.kill(supervisor_pid, signal.SIGTERM)
+        raise RestartRequestError("restart_supervisor_unavailable")
+    try:
+        os.kill(supervisor_pid, signal.SIGTERM)
+    except OSError:
+        raise RestartRequestError("restart_supervisor_unavailable") from None
 
 
 def handoff_required_restart_before_launch() -> bool:

app/core/tests/test_recording_event_images.py

@@ -296,6 +296,72 @@ def cache_jobs(self) -> int:
     assert "scheduled-job" in alert.scheduled_recordings
 
 
+@pytest.mark.asyncio
+async def test_old_active_scheduled_job_is_retained_and_starts_as_scheduled():
+    alert = _build_alert()
+    alert.session_manager.cleanup = AsyncMock()
+    job = {
+        "id": "scheduled-old",
+        "name": "Late Movie",
+        "start_time": int(time.time()) - 10,
+        "duration": 3600,
+        "channels": [],
+        "item": {},
+    }
+    alert.scheduled_recordings = {
+        job["id"]: {"job": job, "created_at": time.time() - 90000}
+    }
+    alert.job_provider.is_job_active = MagicMock(return_value=True)
+    alert.job_provider.cache_jobs = MagicMock(return_value=1)
+    alert.recording_started_enabled = False
+
+    await alert.run_cleanup()
+
+    assert job["id"] in alert.scheduled_recordings
+    with patch.object(
+        recording_events_module, "record_recording_event", return_value=True
+    ) as mock_record:
+        await alert._handle_recording_started({}, job_details=job)
+
+    assert mock_record.call_args.kwargs["extra"]["recording_type"] == "(Scheduled)"
+
+
+@pytest.mark.asyncio
+async def test_old_inactive_scheduled_job_is_removed():
+    alert = _build_alert()
+    alert.session_manager.cleanup = AsyncMock()
+    alert.scheduled_recordings = {
+        "scheduled-old": {"created_at": time.time() - 90000}
+    }
+    alert.job_provider.is_job_active = MagicMock(return_value=False)
+    alert.job_provider.cache_jobs = MagicMock(return_value=0)
+
+    await alert.run_cleanup()
+
+    assert alert.scheduled_recordings == {}
+
+
+@pytest.mark.asyncio
+async def test_started_job_without_scheduled_marker_remains_manual():
+    alert = _build_alert()
+    alert.recording_started_enabled = False
+    job = {
+        "id": "manual-job",
+        "name": "Manual Recording",
+        "start_time": int(time.time()) - 10,
+        "duration": 1800,
+        "channels": [],
+        "item": {},
+    }
+
+    with patch.object(
+        recording_events_module, "record_recording_event", return_value=True
+    ) as mock_record:
+        await alert._handle_recording_started({}, job_details=job)
+
+    assert mock_record.call_args.kwargs["extra"]["recording_type"] == "(Manual)"
+
+
 @pytest.mark.asyncio
 async def test_event_processing_does_not_hold_busy_lock_across_handler_work():
     alert = _build_alert()