fix(ci): separate image license inventory from security findings

Author: fmind

.github/workflows/cd.yml

@@ -93,7 +93,12 @@ jobs:
       - name: Scan candidate image
         env:
           IMAGE_REF: ${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
-        run: mise exec -- trivy --config trivy.yaml image --skip-dirs '' --platform linux/amd64 "$IMAGE_REF"
+        run: mise exec -- trivy --config trivy.yaml image --skip-dirs '' --platform linux/amd64 --scanners misconfig,secret,vuln "$IMAGE_REF"
+      - name: Record license inventory
+        env:
+          IMAGE_REF: ${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
+        # Debian ships reciprocal licenses; inventory them separately from security findings.
+        run: mise exec -- trivy --config trivy.yaml image --skip-dirs '' --platform linux/amd64 --scanners license --exit-code 0 "$IMAGE_REF"
       - name: Promote verified digest
         env:
           IMAGE_REF: ${{ env.IMAGE }}@${{ steps.build.outputs.digest }}

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project are documented in this file.
 
+## [7.0.1] - 2026-10-12
+
+- Separate the Debian license inventory from the vulnerability, secret and misconfiguration image gate.
+
 ## [7.0.0] - 2026-10-12
 
 - **Breaking:** training and serving inputs exclude `casual` and `registered`. Retrain historical registered models before sending feature-only inputs.

README.md

@@ -1145,3 +1145,5 @@ This section provides resources for building packages for Python and AI/ML/MLOps
 `mise run clean` removes caches and build outputs while preserving MLflow databases, run artifacts, and predictions. Back up experiment state before any deliberate manual reset.
 
 Use `mise run mlflow:serve` to browse experiments created by local jobs: their artifact URIs contain host paths. Compose can serve metadata from the same SQLite file, but those host paths are not automatically available inside the container. For new HTTP-first experiments, configure clients to reach the server and choose server-accessible artifact storage.
+
+The release image gate checks vulnerabilities, secrets and misconfigurations. It records license classifications separately: the Debian base includes reciprocal licenses that require an inventory, rather than a blanket license prohibition.

pyproject.toml

@@ -5,7 +5,7 @@
 
 [project]
 name = "bikes"
-version = "7.0.0"
+version = "7.0.1"
 description = "Predict hourly bike rental demand."
 authors = [{ name = "Médéric HURIER", email = "github@fmind.dev" }]
 readme = "README.md"