[Wikid82]

Summary

Makes CrowdSec start, reload and import checks wait for the engine instead of racing it.

• Start no longer waits out its full timeout when the engine exits while starting; it answers 500 crowdsec_engine_exited, reverts the switch and shows a message in the UI.
• Whitelist and hub changes made right after Start are applied by one reloader once CrowdSec has finished starting. A deferred reload is reported as reload_pending (shown as a passive "reload scheduled" note) instead of "reload required".
• The Charon whitelist file stays in place while the engine runs (an empty list keeps a never-matching placeholder).
• A configuration import is checked before it is used: config.yaml needs a config_paths section, and the engine's own -t check must accept it (skipped with a warning if the check cannot run, or when its output points at the environment: busy port or database, missing notification plugins). A failed whitelist regeneration after import now rolls back.
• The engine is started with SIGHUP ignored until it is running; process identity recognises that wrapper form.

Commits

Eight commits plus the QA report: specs, process identity, engine-exit detection, reloader (with frontend), whitelist placeholder, import check, a plugin-aware skip for that check, docs, and review fold-ins.

Testing

• Backend coverage 91.85% (gate 87%); frontend lines 91.10% (gate 85%); patch coverage 94.0%.
• Targeted Playwright: import and first-enable (security-tests) 62/62, whitelist (firefox) 12/12.
• Container gate in throwaway containers: whitelist add 0.1 to 3 s after Start (21/21 alive), occupied-port Start, concurrent Start/Stop, placeholder behaviour and a 45 s stress, import archives (export, stock layout, no config_paths, broken config_dir), SIGHUP pair, decision ban through a proxy host.
• Not run: the hub-restore refusal case (needs hub access); CodeQL and Trivy run in CI.
• Known flake: TestPerf_GetStatus_Parallel_AssertThreshold can miss its 5 ms threshold under full-package load; passes alone.

See docs/reports/qa_report.md.

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
github.com/gin-contrib/gzip @ 1.2.9 backend/go.mod				🔗
github.com/gin-contrib/sse @ 1.2.0 backend/go.mod				🔗
github.com/pandatix/go-abnf @ 0.5.4 backend/go.mod				🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1875

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	1
🟢 Low	0
Total	1

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

❌ Patch coverage is 88.62069% with 33 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
backend/internal/api/handlers/crowdsec_exec.go	86.36%	12 Missing ⚠️
backend/internal/api/handlers/crowdsec_handler.go	78.26%	10 Missing ⚠️
backend/internal/api/handlers/crowdsec_reload.go	92.45%	8 Missing ⚠️
...nd/internal/services/crowdsec_whitelist_service.go	84.61%	2 Missing ⚠️
...ackend/internal/api/handlers/crowdsec_lifecycle.go	94.11%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!