cyber-dojo · JonJagger · Feb 13, 2026 · Feb 12, 2026 · Feb 12, 2026 · Feb 12, 2026
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -286,50 +286,6 @@ jobs:
             --type=coverage-metrics
 
 
-  snyk-container-scan:
-    runs-on: ubuntu-latest
-    needs: [build-image]
-    env:
-      IMAGE_NAME:        ${{ needs.build-image.outputs.tagged_image_name }}
-      KOSLI_FINGERPRINT: ${{ needs.build-image.outputs.digest }}
-      SARIF_FILENAME:    snyk.container.scan.json
-    steps:
-      - name: Download docker image
-        uses: cyber-dojo/download-artifact@main
-        with:
-          image_digest: ${{ needs.build-image.outputs.digest }}
-
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Setup Snyk
-        uses: snyk/actions/setup@master
-
-      - name: Run Snyk container scan
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        run:
-          snyk container test ${IMAGE_NAME}
-            --policy-path=.snyk
-            --sarif
-            --sarif-file-output="${SARIF_FILENAME}"
-
-      - name: Setup Kosli CLI
-        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
-        uses: kosli-dev/setup-cli-action@v2
-        with:
-          version: ${{ vars.KOSLI_CLI_VERSION }}
-
-      - name: Attest evidence to Kosli
-        if: ${{ github.ref == 'refs/heads/main' && (success() || failure()) }}
-        run:
-          kosli attest snyk
-            --attachments=.snyk
-            --name=differ.snyk-container-scan
-            --scan-results="${SARIF_FILENAME}"
-
-
   sonarcloud-scan:
     runs-on: ubuntu-latest
     needs: [build-image]
@@ -361,7 +317,6 @@ jobs:
       - rubocop-lint
       - unit-tests
       - integration-tests
-      - snyk-container-scan
       - snyk-code-scan
       - sonarcloud-scan
     env:

diff --git a/.github/workflows/readme.md b/.github/workflows/readme.md
@@ -3,8 +3,6 @@
 
 ## main.yml 
 main.yml runs when there is a pushed commit.
-Reports to https://app.kosli.com  
-The workflow to look in if you want to learn about [Kosli](https://kosli.com).
 The main structure in this workflow is:
 - The build-image job calls a [reusable-workflow](https://github.com/cyber-dojo/reusable-actions-workflows) which:
   - builds the image
@@ -16,6 +14,9 @@ The main structure in this workflow is:
   - They load it from the Github Action cache using [cyber-dojo/download-artifact@main](https://github.com/cyber-dojo/download-artifact)
   - The kosli-attest commands use the fingerprint returned from the build-image job
 
+Reports compliance to https://app.kosli.com  
+The workflow to look in if you want to learn about [Kosli](https://app.kosli.com/cyber-dojo/flows/differ-ci/trails/).
+
 
 ## deploy-manually-to-aws-beta.yml 
 Deliberately run a non-compliant (but functional) artifact to https://beta.cyber-dojo.org for Kosli demo purposes.  

diff --git a/.kosli.yml b/.kosli.yml
@@ -9,8 +9,6 @@ trail:
       attestations:
         - name: rubocop-lint
           type: junit
-        - name: snyk-container-scan
-          type: snyk
         - name: snyk-code-scan
           type: snyk
         - name: unit-test

diff --git a/.rubocop.yml b/.rubocop.yml
@@ -51,6 +51,10 @@ Style/FetchEnvVar:
   Exclude:
     - source/server/app_base.rb
 
+Style/FrozenStringLiteralComment:
+  Exclude:
+    - source/**/*
+
 Style/HashConversion:
   Exclude:
     - source/server/app_base.rb

diff --git a/source/client/client.rb b/source/client/client.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'http_json_args'
 require 'json'
 require 'rack'

diff --git a/source/client/config/config.ru b/source/client/config/config.ru
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 $stdout.sync = true
 $stderr.sync = true
 

diff --git a/source/client/config/puma.rb b/source/client/config/puma.rb
@@ -1,5 +1,4 @@
 #!/usr/bin/env puma
-# frozen_string_literal: true
 
 environment('production')
 rackup("#{__dir__}/config.ru")
diff --git a/source/client/config/up.sh b/source/client/config/up.sh
@@ -1,9 +1,10 @@
-#!/bin/bash -Eeu
+#!/usr/bin/env bash
+set -Eeu
 
 readonly PORT="${CYBER_DOJO_DIFFER_CLIENT_PORT}"
 readonly MY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-export RUBYOPT='-W2'
+export RUBYOPT='-W2 --enable-frozen-string-literal'
 
 puma \
   --port=${PORT} \

diff --git a/source/client/differ.rb b/source/client/differ.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'http_json_hash/service'
 
 module External

diff --git a/source/client/html_demo.rb b/source/client/html_demo.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'differ'
 
 class HtmlDemo

diff --git a/source/client/http_json_args.rb b/source/client/http_json_args.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 class HttpJsonArgs
   def get(path)
     case path

diff --git a/source/client/http_json_hash/http.rb b/source/client/http_json_hash/http.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'net/http'
 
 module HttpJsonHash

diff --git a/source/client/http_json_hash/requester.rb b/source/client/http_json_hash/requester.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'http'
 require 'json'
 require 'uri'

diff --git a/source/client/http_json_hash/service.rb b/source/client/http_json_hash/service.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'requester'
 require_relative 'unpacker'
 

diff --git a/source/client/http_json_hash/service_error.rb b/source/client/http_json_hash/service_error.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'json'
 
 module HttpJsonHash

diff --git a/source/client/http_json_hash/unpacker.rb b/source/client/http_json_hash/unpacker.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'service_error'
 require 'json'
 

diff --git a/source/client/saver.rb b/source/client/saver.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'http_json_hash/service'
 
 module External

diff --git a/source/server/app.rb b/source/server/app.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'app_base'
 require_relative 'differ'
 require_relative 'prober'

diff --git a/source/server/app_base.rb b/source/server/app_base.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'silently'
 silently { require 'sinatra/contrib' } # N x "warning: method redefined"
 require_relative 'http_json_hash/service'

diff --git a/source/server/config/config.ru b/source/server/config/config.ru
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 $stdout.sync = true
 $stderr.sync = true
 

diff --git a/source/server/config/puma.rb b/source/server/config/puma.rb
@@ -1,5 +1,4 @@
 #!/usr/bin/env puma
-# frozen_string_literal: true
 
 environment('production')
 rackup("#{__dir__}/config.ru")
diff --git a/source/server/config/up.sh b/source/server/config/up.sh
@@ -1,9 +1,10 @@
-#!/bin/bash -Eeu
+#!/usr/bin/env bash
+set -Eeu
 
 readonly PORT="${CYBER_DOJO_DIFFER_PORT}"
 readonly MY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-export RUBYOPT='-W2'
+export RUBYOPT='-W2 --enable-frozen-string-literal'
 
 puma \
   --port=${PORT} \

diff --git a/source/server/differ.rb b/source/server/differ.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'git_differ'
 require_relative 'git_diff_parser'
 

diff --git a/source/server/external/disk_writer.rb b/source/server/external/disk_writer.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module External
   class DiskWriter
     def write(pathed_filename, content)

diff --git a/source/server/external/gitter.rb b/source/server/external/gitter.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module External
   class Gitter
     def initialize(externals)

diff --git a/source/server/external/http.rb b/source/server/external/http.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'net/http'
 
 module External

diff --git a/source/server/external/saver.rb b/source/server/external/saver.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative '../http_json_hash/service'
 
 module External

diff --git a/source/server/external/sheller.rb b/source/server/external/sheller.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative '../utf8_clean'
 require 'open3'
 

diff --git a/source/server/externals.rb b/source/server/externals.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'external/disk_writer'
 require_relative 'external/gitter'
 require_relative 'external/http'

diff --git a/source/server/git_diff_parse_filenames.rb b/source/server/git_diff_parse_filenames.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module GitDiffParseFilenames
   def parse_old_new_filenames(header)
     old_filename, new_filename = old_new_filenames(header[0])

diff --git a/source/server/git_diff_parser.rb b/source/server/git_diff_parser.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'git_diff_parse_filenames'
 
 class GitDiffParser

diff --git a/source/server/git_differ.rb b/source/server/git_differ.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 class GitDiffer
   def initialize(external)
     @external = external

diff --git a/source/server/http_json_hash/requester.rb b/source/server/http_json_hash/requester.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'json'
 require 'uri'
 

diff --git a/source/server/http_json_hash/service.rb b/source/server/http_json_hash/service.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'requester'
 require_relative 'unpacker'
 

diff --git a/source/server/http_json_hash/service_error.rb b/source/server/http_json_hash/service_error.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module HttpJsonHash
   class ServiceError < RuntimeError
     def initialize(name, path, args, body, message)

diff --git a/source/server/http_json_hash/unpacker.rb b/source/server/http_json_hash/unpacker.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'service_error'
 require 'json'
 

diff --git a/source/server/prober.rb b/source/server/prober.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 class Prober
   def initialize(externals)
     @externals = externals

diff --git a/source/server/silently.rb b/source/server/silently.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 def silently
   old_stderr = $stderr
   $stderr = StringIO.new

diff --git a/source/server/utf8_clean.rb b/source/server/utf8_clean.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Utf8
   def self.clean(str)
     # force an encoding change - if encoding is already utf-8

diff --git a/test/client/client_test_base.rb b/test/client/client_test_base.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'lib/id58_test_base'
 require_app 'differ'
 require_app 'saver'

diff --git a/test/client/differ_client_test.rb b/test/client/differ_client_test.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'client_test_base'
 require 'cgi'
 

diff --git a/test/client/http_response_unpacker_test.rb b/test/client/http_response_unpacker_test.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'client_test_base'
 require_app 'http_json_hash/unpacker'
 require 'ostruct'

diff --git a/test/client/lib/check_metrics.rb b/test/client/lib/check_metrics.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'json'
 
 def coloured(arg)

diff --git a/test/client/lib/coverage.rb b/test/client/lib/coverage.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'simplecov'
 require_relative 'simplecov_formatter_json'
 

diff --git a/test/client/lib/coverage_metrics_limits.rb b/test/client/lib/coverage_metrics_limits.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 def metrics
   [
     [ nil ],

diff --git a/test/client/lib/id58_test_base.rb b/test/client/lib/id58_test_base.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'English'
 require 'minitest/autorun'
 require 'minitest/reporters'

diff --git a/test/client/lib/run.sh b/test/client/lib/run.sh
@@ -15,10 +15,10 @@ require '${MY_DIR}/coverage.rb'
   require file
 }"
 
-export RUBYOPT='-W2'
 mkdir -p "${COVERAGE_ROOT}"
 
 set +e
+export RUBYOPT='-W2 --enable-frozen-string-literal'
 ruby -e "${SCRIPT}" -- ${TEST_ARGS[@]} 2>&1 | tee "${COVERAGE_ROOT}/${TEST_LOG}"
 STATUS=${PIPESTATUS[0]}
 set -e

diff --git a/test/client/lib/simplecov_formatter_json.rb b/test/client/lib/simplecov_formatter_json.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'simplecov'
 require 'json'
 

diff --git a/test/client/lib/slim_json_reporter.rb b/test/client/lib/slim_json_reporter.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require 'json'
 require 'minitest/reporters'
 

diff --git a/test/client/lib/test_metrics_limits.rb b/test/client/lib/test_metrics_limits.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 def metrics
   [
     [ nil ],

diff --git a/test/server/diff_summary_test.rb b/test/server/diff_summary_test.rb
@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 require_relative 'differ_test_base'
 
 class DiffSummaryTest < DifferTestBase