Last night, more Lightwell fixes dropped. Here's the morning after.
14
CVEs remediated
286
Patches already merged
12
Flagged for review
298 patches. 29 applications. CVEs analyzed, risk assessed, merge requests generated, safe ones already merged. Built on tools you may already have.
The scenario
Same process. Different risk class.
Critical
wire-transfer-service
Customer-facing trade execution. PCI-regulated. Spring Boot. Requires human review.
Non-critical
benefits-mgmt-app
Internal benefits system. Risk Class MED. Goes through automatically.
Dinesh manages 29 apps at Acme Corp. and here is how Lightwell patches were managed overnight — analyzing CVEs, classifying risk, and routing each one accordingly. We follow two through the same pipeline to show both outcomes.
Ansible / EDA
Dinesh's operational view.
The overview of the entire process from inside Ansible. A great place to understand the end-to-end flow and integrate with other systems. Today we're focused on the fastpath for our two applications.
First we need to understand our Lightwell-provided fixes — analyze the fix, understand its contents, and identify the impacted applications. We do this by working with our SBOMs using our Trusted Profile Analyzer.
With Lightwell, we provided a set of Skills to operate as our glue — driving further analysis, creating the merge request, and driving your CI setups, including unit testing. Single agent, not a fleet. Every decision is logged and attached to the MR it opened.
We use source control for managing our CI pipelines. This is where the critical trade application needs a human to pick up. The agent did the analysis, created the MR, ran the checks.
Dinesh's job: the approval. RHOAI and Ansible drove everything that got us here.
The process is exactly the same for our non-critical app — the MR is automatically approved once everything is green. Then back to Ansible: the perfect catch-up point to see where we are across both applications.
We need to build our new application artifacts for deployment with appropriate guardrails and perform further hardening. Another pipeline just like Ansible — and like the CI environments you already have.
Ready for production — whatever that means for you.
Our critical application goes through an image build — Ansible is ensuring that's handled. Our non-critical is already containerized, so we push it to prod with OpenShift. Versions match TSF output exactly.
The MR merge triggered the EDA event. Ansible ran the deployment workflow end-to-end — build verified, image signed, prod updated. The SNOW ticket is closed. Audit trail is complete.
This workflow integrates Red Hat technology and tools you own and are familiar with to get Lightwell fixes out to production. The pieces already exist. We can help you get there.
Info
Arch
Architecture
The full pipeline — from Lightwell publishing a fix to a signed image in production.