fix(security): bind repository scanners to exact PR head - #799
fix(security): bind repository scanners to exact PR head#799seonghobae wants to merge 7 commits into
Conversation
|
Warning Review limit reached
Next review available in: 1 minute Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
Comment |
|
@opencode-agent Extend this exact-current-head security-scan repair test-first to address #810, and do nothing if PR #799 branch head is no longer A downstream exact-head canary exposed a valid organization-level fail-open defect in the same workflow. Use two auditable commits in order:
Update doctoring so its claimed fail-closed behavior matches production and include current APA 7 primary references to GitHub Dependency Review, Dependency Graph, and Dependency Review REST API. Add one concise Do not change After GREEN, run the focused dependency-free contract and the complete central Python test/100% statement+branch coverage/public-docstring/compile contract available on the branch. Then leave PR #799 unmerged and request fresh exact-GREEN CodeRabbit/OpenCode/Noema review plus every required security workflow; do not claim queued, absent, skipped, predecessor-head, or synthetic-merge evidence as current-head success. Report immutable RED and GREEN SHAs in this PR conversation. |
|
@opencode-agent Extend this existing security-scan repair test-first on exact current head Fresh downstream evidence from Use the existing PR #799 rather than creating a competing PR because it already owns Required RED → GREEN extension:
Modify only the already-owned PR #799 security-scan workflow/contract/helper/documentation/CHANGELOG surface needed for this repair. Do not add any repository-write, OIDC, branch/ref publication, PR creation/merge, release/package/signing authority, temporary write-capable workflow, self-modifying workflow, model-modified-tree publication, or conflict strategy. Do not merge or mark Ready. After GREEN, require fresh exact-current-head central quality/security/review evidence and preserve independent non-author approval and branch protection as mandatory gates. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
protected_main='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
printf '%s\n' '== Current commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit exists =='
git rev-parse "${requested_head}^{commit}"
printf '%s\n' '== Requested protected commit exists =='
git rev-parse "${protected_main}^{commit}"
printf '%s\n' '== Merge base =='
git merge-base "$protected_main" "$requested_head"
printf '%s\n' '== Changed files =='
git diff --name-status "$protected_main" "$requested_head"
printf '%s\n' '== Workflow outline =='
ast-grep outline .github/workflows/security-scan.yml --items all || true
printf '%s\n' '== Focused test candidates =='
fd -t f 'security.*scan.*exact.*head|exact.*head.*security.*scan|security.*scan.*dependency.*review' tests . 2>/dev/null || true
printf '%s\n' '== Workflow security-sensitive lines =='
rg -n -C 4 --glob '.github/workflows/security-scan.yml' \
'actions/checkout|dependency-review-action|upload-sarif|head\.repo|head\.sha|refs/pull|persist-credentials|permissions:|security-events|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity' .Length of output: 2385 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
for file in \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
do
printf '\n== %s ==\n' "$file"
nl -ba "$file"
done
printf '\n== Complete diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.mdLength of output: 1191 🏁 Script executed: #!/bin/bash
set -u
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
print_file() {
file="$1"
printf '\n== %s ==\n' "$file"
if command -v awk >/dev/null 2>&1; then
awk '{ printf "%6d %s\n", NR, $0 }' "$file"
else
cat "$file"
fi
}
for file in \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
do
print_file "$file"
done
printf '\n== Complete scoped diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md || trueLength of output: 65118 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
--jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'
printf '%s\n' '== Check runs for the requested head =='
gh api "repos/${repo}/commits/aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url}'
printf '%s\n' '== Workflow-run conclusions for the requested head =='
gh run list --repo "$repo" \
--commit aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae \
--limit 100 \
--json databaseId,name,status,conclusion,event,headSha,url \
--jq '.[] | {databaseId, name, status, conclusion, event, headSha, url}'Length of output: 23567
Finding — P1: dependency-review can succeed without dependency-review evidence In Treat unavailable support as unavailable security evidence. Fail the job with a concise error that identifies the repository and exact base/head. Do not print the response body. This behavior is relevant to the reported EgressWeave public-repository The remaining requested controls are present:
I cannot approve while the dependency-review fail-open path remains.
|
1 participant
Purpose
Restore exact-head security evidence for organization-required repository scanners. DiskSage PR #137 exact head
87ac0e08cceed3d1a766da13a8f8123912178192exposed that Security Scan run31070907732checked out GitHub's synthetic pull-request merge ref for Trivy instead of the literal contributor head, so the green result could not satisfy exact-head authorization policy.Implemented boundary
refs/pull/<number>/headand the same exact head SHA;TDD evidence
3a1f49a6d5e07b2a3aedd42627579d3e4d3213ce: quality run31078988647, job92543220656, failed inExecute dependency-free exact-head contractbecause the three affected jobs still relied on the synthetic merge checkout.aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae: quality run31079215588, job92543948287, passed both checkout and SARIF contracts.31079215609passed dependency-review, OSV, Trivy, and Scorecard. Trivy job92544007320checked outaee317b3ecbfaad7cdb3898e603dfe5e69b8f7aeand uploaded SARIF asrefs/pull/799/headwith the same SHA.Documentation
docs/doctoring/security-scan-exact-head.mdrecords the authorization boundary, fail-closed behavior, rollback contract, initiating DiskSage evidence, and APA 7th references to current authoritative GitHub documentation.CHANGELOG.mdrecords the repair.Merge gate
Keep Draft until the exact current head passes complete central tests, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, SBOM, current-head automated review, independent non-author approval, zero unresolved valid findings, and branch protection without bypass.