fix(security): bind repository scanners to exact PR head - #799

sequenceDiagram
  participant PullRequest
  participant GitHubActions
  participant DependencyReviewAPI
  participant Trivy
  participant Scorecard
  participant SARIFUpload
  PullRequest->>GitHubActions: head repository와 head SHA 제공
  GitHubActions->>DependencyReviewAPI: base SHA와 head SHA 비교 요청
  DependencyReviewAPI-->>GitHubActions: HTTP 200 또는 실패 상태 반환
  GitHubActions->>Trivy: head repository와 head SHA checkout
  GitHubActions->>Scorecard: head repository와 head SHA checkout
  Trivy->>SARIFUpload: head ref와 head SHA를 포함한 SARIF 업로드
  Scorecard->>SARIFUpload: head ref와 head SHA를 포함한 SARIF 업로드

_{Comment @coderabbitai help to get the list of available commands.}

@opencode-agent Extend this exact-current-head security-scan repair test-first to address #810, and do nothing if PR #799 branch head is no longer aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae.

A downstream exact-head canary exposed a valid organization-level fail-open defect in the same workflow. ContextualWisdomLab/EgressWeave is public. On EgressWeave PR #66 exact head c038a9509d1a8eae8561cc9081e67e12bd373d42, Security Scan run 31108241013, dependency-review job 92638903658, the exact compare 10d0c51daf2ad278d66f43be479df8cf6b08ba6d...c038a9509d1a8eae8561cc9081e67e12bd373d42 returned HTTP 403; central security-scan.yml warned that dependency review was unavailable, set supported=false, skipped actions/dependency-review-action, and returned a green job/workflow. GitHub currently documents dependency review/action as available for public GitHub.com repositories when dependency graph is enabled, and the public-resource REST compare does not require authentication. Treat this as unavailable security evidence, not a clean dependency review. Do not guess the root cause of the 403.

Use two auditable commits in order:

1. Immutable RED test-only commit. Modify only tests/test_security_scan_exact_head.py (or add one tightly focused tests/test_security_scan_dependency_review.py if substantially clearer). Add a deterministic static/contract regression that fails on current head because 403/404 are converted to supported=false + exit 0 / success and because the hard action is conditionally skipped. Require the central contract to distinguish an executed clean review from API unavailability and to fail closed for public-repository unavailability. Preserve all existing exact-head checkout and SARIF contracts.

2. GREEN bounded repair. Modify only .github/workflows/security-scan.yml, the focused test above, docs/doctoring/security-scan-exact-head.md, and CHANGELOG.md. For the dependency-review support probe:

   • keep exact BASE_SHA/HEAD_SHA, exact PR-head checkout, read-only permissions, persisted credentials disabled, and the immutable actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 pin;
   • 200 may continue to the hard dependency-review action;
   • 403, 404, empty/malformed status, curl/transport failure, timeout, and any unexpected status must not yield a successful dependency-review result for a public repository; fail closed with a concise actionable error that identifies repository plus exact base/head and HTTP status but does not print auth material or an untrusted response body;
   • do not use OSV, Trivy, Scorecard, CodeQL, or another scanner as a semantic substitute for dependency review;
   • do not introduce branch-controlled opt-outs or infer not-applicable from 403/404. If private/internal repository exceptions are required, leave that as the separately governed policy decision in security: make central dependency-review unavailability fail closed #810 rather than weakening this public-repository canary repair.

Update doctoring so its claimed fail-closed behavior matches production and include current APA 7 primary references to GitHub Dependency Review, Dependency Graph, and Dependency Review REST API. Add one concise [Unreleased] Security entry; no version/release bump.

Do not change .github/workflows/security-scan-exact-head-quality-ci.yml unless the existing permanent exact-head quality job cannot discover the new focused test without a minimal dependency-free update. Do not modify any other workflow, OpenCode/Noema/Strix credentials or identities, dependencies, repository protections, publication/release/tag/ref behavior, model provider, or caller. Never add a temporary/self-modifying/write-capable repair workflow, contents: write, OIDC, branch push, merge/rebase, auto-merge, -X ours/theirs, or execution of model-modified source under a write credential.

After GREEN, run the focused dependency-free contract and the complete central Python test/100% statement+branch coverage/public-docstring/compile contract available on the branch. Then leave PR #799 unmerged and request fresh exact-GREEN CodeRabbit/OpenCode/Noema review plus every required security workflow; do not claim queued, absent, skipped, predecessor-head, or synthetic-merge evidence as current-head success. Report immutable RED and GREEN SHAs in this PR conversation.

@opencode-agent Extend this existing security-scan repair test-first on exact current head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae; stop without writing if the head differs.

Fresh downstream evidence from ContextualWisdomLab/EgressWeave#66 exact head c038a9509d1a8eae8561cc9081e67e12bd373d42 exposed a still-valid organization-level fail-open dependency-review path. Security Scan run 31108241013, job 92638903658, queried exact base 10d0c51daf2ad278d66f43be479df8cf6b08ba6d and exact head c038a9509d1a8eae8561cc9081e67e12bd373d42; the dependency-graph compare endpoint returned HTTP 403. The current central step then emitted Dependency review is unavailable for ContextualWisdomLab/EgressWeave; skipping dependency-review hard gate., set supported=false, skipped actions/dependency-review-action, and allowed the dependency-review job and aggregate Security Scan to conclude success. This is tracked as ContextualWisdomLab/EgressWeave#76. PR #66 does not change dependency inputs, so do not claim it introduced a vulnerable dependency; repair the assurance semantics instead.

Use the existing PR #799 rather than creating a competing PR because it already owns .github/workflows/security-scan.yml, its exact-head contracts, doctoring, and CHANGELOG. Preserve the exact-head checkout/SARIF repair already present.

Required RED → GREEN extension:

1. First commit immutable test-only RED evidence in the existing security-scan contract tests proving that HTTP 403/404 from dependency-review support cannot be represented as a passed dependency-review gate.
2. Preserve 200 as the only path that may execute the pinned dependency-review action.
3. For unavailable 403/404, classify the exact PR base..head conservatively and deterministically. If any supported dependency manifest, lock, dependency-submission definition, package-resolution input, or an unknown/truncated classification state is present, fail closed. If and only if the complete exact diff proves no dependency-sensitive path changed, emit an explicit exact-base/exact-head not-applicable outcome; never call that passed.
4. Any GitHub API enumeration used for classification must paginate fully, bind repository/PR/base/head identities, reject stale heads, and fail closed on malformed responses, page/record limits, truncation, rate/permission failures, or identity drift. Prefer an already-authenticated exact-tree method if it gives stronger completeness evidence. Do not rely on the capped compare-file list as complete evidence.
5. Keep contents/pull-requests read-only, persist-credentials: false, immutable action pins, fork-read-only behavior, OSV, Trivy, Scorecard, CodeQL/GHAS, Semgrep, Dependabot and existing scanner semantics unchanged except for the corrected dependency-review outcome.
6. Add focused positive/negative/adversarial tests for dependency-sensitive paths, dependency-neutral paths, stale-head refusal, pagination/completeness, malformed/unavailable responses, and the exact EgressWeave 403 shape. Maintain 100% production statement/branch coverage and beginner-readable public docstrings for any helper added.
7. Update docs/doctoring/security-scan-exact-head.md with passed vs exact-bound not-applicable vs unavailable/fail-closed, administrator remediation for enabling GitHub dependency graph/Code Security when entitlement permits, and APA 7 primary GitHub references. Prepend one [Unreleased] Security entry; do not bump a version.

Modify only the already-owned PR #799 security-scan workflow/contract/helper/documentation/CHANGELOG surface needed for this repair. Do not add any repository-write, OIDC, branch/ref publication, PR creation/merge, release/package/signing authority, temporary write-capable workflow, self-modifying workflow, model-modified-tree publication, or conflict strategy. Do not merge or mark Ready. After GREEN, require fresh exact-current-head central quality/security/review evidence and preserve independent non-author approval and branch protection as mandatory gates.

@opencode-agent @cwl-noema-review @coderabbitai review

Review-only request for exact current head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae against protected main f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae. Exact-head Security Scan Exact-Head Quality CI, Security Scan, CodeQL, Python Security, Semgrep, Secret Scan, OSV, Scorecard, and SBOM are complete and successful; unresolved threads are zero. Validate explicit head-repository/SHA checkout for dependency review, Trivy, and Scorecard; exact-head SARIF ref/SHA binding; fork read-only support; and preservation of existing scanner severity and least-privilege policy. Do not mutate the branch or merge; submit actionable findings or a formal exact-head review.

#!/bin/bash
set -euo pipefail

requested_head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
protected_main='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'

printf '%s\n' '== Current commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit exists =='
git rev-parse "${requested_head}^{commit}"
printf '%s\n' '== Requested protected commit exists =='
git rev-parse "${protected_main}^{commit}"
printf '%s\n' '== Merge base =='
git merge-base "$protected_main" "$requested_head"
printf '%s\n' '== Changed files =='
git diff --name-status "$protected_main" "$requested_head"
printf '%s\n' '== Workflow outline =='
ast-grep outline .github/workflows/security-scan.yml --items all || true
printf '%s\n' '== Focused test candidates =='
fd -t f 'security.*scan.*exact.*head|exact.*head.*security.*scan|security.*scan.*dependency.*review' tests . 2>/dev/null || true
printf '%s\n' '== Workflow security-sensitive lines =='
rg -n -C 4 --glob '.github/workflows/security-scan.yml' \
  'actions/checkout|dependency-review-action|upload-sarif|head\.repo|head\.sha|refs/pull|persist-credentials|permissions:|security-events|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity' .

#!/bin/bash
set -euo pipefail

base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'

for file in \
  .github/workflows/security-scan.yml \
  .github/workflows/security-scan-exact-head-quality-ci.yml \
  tests/test_security_scan_exact_head.py \
  tests/test_security_scan_sarif_exact_head.py \
  docs/doctoring/security-scan-exact-head.md \
  CHANGELOG.md
do
  printf '\n== %s ==\n' "$file"
  nl -ba "$file"
done

printf '\n== Complete diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
  .github/workflows/security-scan.yml \
  .github/workflows/security-scan-exact-head-quality-ci.yml \
  tests/test_security_scan_exact_head.py \
  tests/test_security_scan_sarif_exact_head.py \
  docs/doctoring/security-scan-exact-head.md \
  CHANGELOG.md

#!/bin/bash
set -u

base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'

print_file() {
  file="$1"
  printf '\n== %s ==\n' "$file"
  if command -v awk >/dev/null 2>&1; then
    awk '{ printf "%6d  %s\n", NR, $0 }' "$file"
  else
    cat "$file"
  fi
}

for file in \
  .github/workflows/security-scan.yml \
  .github/workflows/security-scan-exact-head-quality-ci.yml \
  tests/test_security_scan_exact_head.py \
  tests/test_security_scan_sarif_exact_head.py \
  docs/doctoring/security-scan-exact-head.md \
  CHANGELOG.md
do
  print_file "$file"
done

printf '\n== Complete scoped diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
  .github/workflows/security-scan.yml \
  .github/workflows/security-scan-exact-head-quality-ci.yml \
  tests/test_security_scan_exact_head.py \
  tests/test_security_scan_sarif_exact_head.py \
  docs/doctoring/security-scan-exact-head.md \
  CHANGELOG.md || true

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='799'

printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
  --json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
  --jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'

printf '%s\n' '== Check runs for the requested head =='
gh api "repos/${repo}/commits/aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae/check-runs?per_page=100" \
  --jq '.check_runs[] | {name, status, conclusion, details_url}'

printf '%s\n' '== Workflow-run conclusions for the requested head =='
gh run list --repo "$repo" \
  --commit aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae \
  --limit 100 \
  --json databaseId,name,status,conclusion,event,headSha,url \
  --jq '.[] | {databaseId, name, status, conclusion, event, headSha, url}'

@seonghobae Formal exact-head review completed for aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae against main f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae.

Finding — P1: dependency-review can succeed without dependency-review evidence

In .github/workflows/security-scan.yml, Line 292 through Line 295 convert dependency-graph compare HTTP 403 or 404 into supported=false and exit successfully. Line 302 then skips the pinned actions/dependency-review-action. The dependency-review job and the required Security Scan workflow can therefore pass without a dependency review.

Treat unavailable support as unavailable security evidence. Fail the job with a concise error that identifies the repository and exact base/head. Do not print the response body. This behavior is relevant to the reported EgressWeave public-repository 403 case.

The remaining requested controls are present:

• Dependency review, Trivy, and Scorecard check out github.event.pull_request.head.repo.full_name at github.event.pull_request.head.sha.
• These checkouts set persist-credentials: false.
• Trivy and Scorecard SARIF uploads bind refs/pull/${{ github.event.pull_request.number }}/head and github.event.pull_request.head.sha.
• Trivy preserves the fixable CRITICAL,HIGH,MEDIUM hard gate.
• Scorecard remains a soft job.
• Workflow permissions remain least-privilege for the scanner roles.
• GitHub reports the named quality, security, review, and SBOM workflows as successful for the requested head.

I cannot approve while the dependency-review fail-open path remains.

@opencode-agent

Review-only request for exact current head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae. Validate that dependency-review, Trivy, and Scorecard check out the explicit PR head repository and immutable SHA, SARIF binds refs/pull/799/head plus the same SHA, fork PRs stay read-only, and the existing scanner severity/policy semantics are unchanged. Do not update or merge.

@cwl-noema-review

Independently review exact current head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae, focusing on exact-head authorization, explicit fork head-repository checkout, SARIF ref/SHA integrity, permission scope, and whether the doctoring claims are supported by current workflow evidence. Do not mutate or merge.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review

Final read-only exact-head review for aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae. Security Scan Exact-Head Quality CI 31079215588 and the current complete security/supply-chain suite are successful, including Security Scan, CodeQL, Python Security, Semgrep, Secret Scan, OSV, Scorecard, and SBOM; CodeRabbit status is successful, zero inline threads remain, and auto-merge is armed. Verify that dependency review, Trivy, and Scorecard bind to the literal PR head repository/SHA; SARIF binds refs/pull/<number>/head and the same SHA; credentials stay unpersisted; fork PRs remain read-only; and OSV/severity/permissions behavior is unchanged. Submit formal exact-head APPROVE only if no actionable defect remains. Do not mutate, manually merge, release, or alter protections.

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 12 minutes and 20 seconds before sending another message.

@opencode-agent review

Review exact head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae read-only. Security Scan Exact-Head Quality 31079215588, current Security Scan 31131595872, Python Security 31131595911, CodeQL 31131595820, Semgrep 31131595832, Secret Scan 31131597658, OSV 31131596407, Scorecard 31131595786, SBOM 31131593849, and CodeRabbit are successful, with zero unresolved threads. Verify dependency-review support, Trivy, and Scorecard check out the explicit pull-request head repository and immutable head SHA; SARIF uploads bind refs/pull/<number>/head and that same SHA; fork PRs remain read-only; persisted credentials remain disabled; and OSV comparison, severity/findings policy, permissions, and immutable action/scanner pins are unchanged. Submit a qualifying non-author approval only if exact-head authorization evidence is complete.

@cwl-noema-review review

Independently review exact head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae read-only, focusing on literal contributor-head authorization, fork-safe repository selection, SARIF ref/SHA binding, persisted credential removal, immutable pins, and preservation of existing scanner semantics. Submit a current-head verdict only; do not mutate or merge.

@opencode-agent Exact-head correction for #810: extend only current PR #799 head 323c07b794d11f82c04db91544bc3a3f5cf5ad5c; stop without writing if the branch head differs. The prior #810 request was intentionally bound to stale predecessor aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae and therefore must not authorize a write now.

Preserve the existing exact-PR-head checkout/SARIF binding repair. Add the dependency-review availability repair test-first in two auditable commits:

1. Immutable RED, test-only: add a focused deterministic contract proving the current 403/404 → supported=false/exit-0 → skipped hard action → green aggregate path is forbidden. Preserve all existing exact-head contracts.
2. GREEN bounded repair: modify only .github/workflows/security-scan.yml, that focused test, docs/doctoring/security-scan-exact-head.md, and CHANGELOG.md (and leave the permanent quality workflow unchanged unless discovery truly requires a minimal dependency-free adjustment). A 200 support probe may continue to the immutable-pinned dependency-review action. For a public repository, 403, 404, empty/malformed status, transport/curl failure, timeout, truncated state, or any unexpected status must fail closed with concise repository + exact base/head + status diagnostics, without auth material or untrusted response bodies. Do not substitute OSV, Trivy, Scorecard, CodeQL, Semgrep, or another scanner for dependency review. Do not infer not-applicable from 403/404 or add a branch-controlled opt-out.

Keep exact BASE_SHA...HEAD_SHA binding, explicit head repo/SHA checkout, persist-credentials: false, read-only permissions, immutable action pins, and the independent scanner surfaces. Add current APA 7 primary GitHub references and one [Unreleased] Security entry; no version bump.

Do not add or use a temporary/self-modifying/write-capable workflow, contents: write, OIDC, branch push, merge/rebase, auto-merge, -X ours/theirs, or execution of model-modified source under a write credential. After GREEN, run the focused dependency-free contract and complete central test/100% statement+branch coverage/public-docstring/compile contract, then request fresh exact-GREEN review and required security workflows. Report immutable RED/GREEN SHAs and exact-head evidence; do not merge or publish.

@opencode-agent

Review-only exact-head request for 323c07b794d11f82c04db91544bc3a3f5cf5ad5c. Validate literal PR-head repository/SHA checkout for dependency review support, Trivy, and Scorecard; exact SARIF ref/SHA binding; fork read-only compatibility; unchanged scanner policies; and all successful exact-head quality/security/supply-chain gates. Do not mutate the branch or merge.

@cwl-noema-review

Independently review exact head 323c07b794d11f82c04db91544bc3a3f5cf5ad5c, focusing on exact-head authorization evidence, explicit head-repository handling for forks, SARIF identity, least privilege, and preservation of existing scanner severity/finding policy. Do not mutate the branch or merge.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Final read-only review for exact head 323c07b794d11f82c04db91544bc3a3f5cf5ad5c. Exact-head quality, CodeQL, Python Security, SAST, Security Scan, Secret Scan, OSV, Scorecard, and SBOM are successful. Verify literal contributor-head checkout and SARIF identity binding for dependency-review support, Trivy, and Scorecard, including fork read-only behavior and persisted-credential denial. Submit a qualifying non-author approval only if no actionable finding remains. Do not mutate the branch, bypass protections, or merge.

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/.github'
pr='799'
head='323c07b794d11f82c04db91544bc3a3f5cf5ad5c'

printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
  --json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
  --jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'

printf '%s\n' '== Local checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit =='
git rev-parse "${head}^{commit}"

printf '%s\n' '== Changed files against PR base =='
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
git diff --name-status "$base" "$head"

printf '%s\n' '== Workflow structure =='
ast-grep outline .github/workflows/security-scan.yml --items all || true

printf '%s\n' '== Exact-head and policy-sensitive workflow lines =='
rg -n -C 5 \
  'actions/checkout|dependency-review-action|upload-sarif|head\.repo\.full_name|head\.sha|refs/pull|persist-credentials|permissions:|security-events:|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity|BASE_SHA|HEAD_SHA|supported=' \
  .github/workflows/security-scan.yml

printf '%s\n' '== Focused contract test candidates =='
fd -t f 'test_security_scan_exact_head.py|test_security_scan_sarif_exact_head.py|test_security_scan_dependency_review.py' tests 2>/dev/null \
  | sort \
  | xargs -r -n1 sh -c 'echo "== $0 =="; sed -n "1,260p" "$0"'

printf '%s\n' '== Scoped documentation and changelog changes =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
  .github/workflows/security-scan.yml \
  .github/workflows/security-scan-exact-head-quality-ci.yml \
  tests/test_security_scan_exact_head.py \
  tests/test_security_scan_sarif_exact_head.py \
  tests/test_security_scan_dependency_review.py \
  docs/doctoring/security-scan-exact-head.md \
  CHANGELOG.md

printf '%s\n' '== Check runs for requested head =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
  --jq '.check_runs[] | {name, status, conclusion, details_url}'

printf '%s\n' '== Workflow runs for requested head =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
  --json databaseId,name,status,conclusion,event,headSha,url \
  --jq '.[] | {databaseId,name,status,conclusion,event,headSha,url}'

@seonghobae Formal exact-head review completed for 323c07b794d11f82c04db91544bc3a3f5cf5ad5c.

Finding — P1: dependency-review can pass without dependency-review evidence

In .github/workflows/security-scan.yml, Line 292 through Line 295 handle HTTP 403 or 404 by setting supported=false and exiting successfully. Line 302 then skips the pinned actions/dependency-review-action. The dependency-review job and the aggregate Security Scan workflow can therefore pass when dependency-review evidence is unavailable.

The exact head still contains the EgressWeave fail-open path from the prior review. Treat 403, 404, malformed status, transport failure, and unexpected status as unavailable security evidence. Fail the job with a concise diagnostic that includes the repository, BASE_SHA, HEAD_SHA, and HTTP status. Do not print credentials or the response body.

The requested exact-head controls are present:

• Dependency review, Trivy, and Scorecard use github.event.pull_request.head.repo.full_name and github.event.pull_request.head.sha.
• These checkouts set persist-credentials: false.
• Trivy and Scorecard SARIF uploads bind refs/pull/${{ github.event.pull_request.number }}/head and github.event.pull_request.head.sha.
• The workflow keeps read-only contents and pull-requests permissions for dependency review.
• Trivy retains the fixable CRITICAL,HIGH,MEDIUM hard gate.
• Scorecard remains a soft posture job.
• The listed quality, security, and supply-chain workflows completed successfully for the requested SHA.

I cannot approve while the dependency-review fail-open path remains.

_{You are interacting with an AI system.}

Supersede the immediately preceding review-only request at issue comment 5210969307 for current head 323c07b794d11f82c04db91544bc3a3f5cf5ad5c. It was generated against a tree that still contains the #810 fail-open dependency-review path and therefore must not be treated as a final-approval request or as evidence that all security/supply-chain gates are trustworthy.

Current-head inspection still shows .github/workflows/security-scan.yml converting dependency-review support-probe HTTP 403/404 into supported=false + exit 0 and conditionally skipping the pinned dependency-review action. The exact-head test-first repair request in comment 5210837930 remains the active mutation instruction for this branch. Do not approve, merge, auto-merge, release, or publish 323c07b794d11f82c04db91544bc3a3f5cf5ad5c as-is.

After a new exact GREEN head implements #810, request fresh CodeRabbit/OpenCode/Noema review and every required quality/security/supply-chain workflow against that new SHA only. Predecessor-head success and this superseded review request are stale evidence.

@opencode-agent Address both current-head CodeRabbit threads on this branch with the minimal TDD change only:

• In .github/workflows/security-scan.yml, add bounded curl connection and total timeouts to the dependency-review support probe (use --connect-timeout 10 --max-time 30) while retaining -o /dev/null, status-only output, and fail-closed non-200/transport behavior.
• In tests/test_security_scan_exact_head.py, first add/verify failing assertions that the exact probe command includes --connect-timeout, --max-time, and a positive response-body discard sink (-o /dev/null or a strictly equivalent sink), rather than merely rejecting cat "$response_file".
• Preserve all exact-head checkout, SARIF identity, dependency-review authorization, token, and failure boundaries.
• Run the focused quality workflow and complete central suite, then request fresh exact-head reviews. Do not create repair automation or weaken the hard gate.

@cwl-noema-review @opencode-agent

Review-only request for live exact head a5f39a4015a721420f2bf7c16f45f2a9ffc8afa1; do not mutate or merge. All currently exposed exact-head quality/security/supply-chain workflows have completed successfully. Re-evaluate explicit PR-head checkout and SARIF identity, the dependency-review support probe's HTTP-200-only fail-closed contract (including 403/404/transport/malformed handling), credential/body redaction, fork read-only behavior, independent scanner boundaries, coverage/docstrings, and APA 7 doctoring. If no blocker remains, submit the strongest formal review state your independent reviewer identity is authorized to provide on this exact head.

@opencode-agent Fix the exact-current-head failed contract on acc0da8063bf32f54ed100430a26d3b2025bb637; stop without writing if the head differs.

Exact-head quality run 31147866151, job 92771079009, fails only test_dependency_review_support_probe_fails_closed_unless_api_returns_200 because the dependency-review support probe's curl command lacks the already-specified finite network bounds --connect-timeout 10 and --max-time 30.

Use the existing immutable RED contract. Modify only .github/workflows/security-scan.yml. In dependency-review → Check dependency review support, add --connect-timeout 10 and --max-time 30 to the existing body-discarding curl -sS -o /dev/null -w '%{http_code}' probe before its headers/URL. Preserve set -euo pipefail, exact base/head binding, token handling, only-HTTP-200 acceptance, || true status capture, fail-closed behavior for 403/404/000/empty/transport/timeout/unexpected states, response-body non-disclosure, immutable action pins, and all permissions. Do not modify tests to weaken the contract and do not touch any other file.

Then rerun the exact-head contract and complete required checks. Do not merge, rebase, retarget, or alter review identities.

@opencode-agent Apply the bounded GREEN workflow repair to exact current head acc0da8063bf32f54ed100430a26d3b2025bb637 on branch fix/security-scan-exact-head.

The exact test-only RED commit is complete. Security Scan Exact-Head Quality CI run 31147866151, job 92771079009, checked out acc0da8063bf32f54ed100430a26d3b2025bb637 and failed only because tests/test_security_scan_exact_head.py now requires the dependency-review support probe to include --connect-timeout 10 and --max-time 30. The same test also positively requires -o /dev/null, which the current workflow already satisfies.

Modify only .github/workflows/security-scan.yml.

In the Check dependency review support curl invocation, replace:

curl -sS -o /dev/null -w '%{http_code}' \

with:

curl -sS --connect-timeout 10 --max-time 30 -o /dev/null -w '%{http_code}' \

Preserve the existing authorization headers, exact base/head URL, discarded response body, || true, only-HTTP-200 success rule, stable fail-closed diagnostic, immutable action pins, permissions, and all other workflow content exactly. Do not modify tests again, other workflows, documentation, changelog, dependencies, credentials, permissions, protected refs, release behavior, branch history, or any other path. Do not rebase, retarget, merge, mark draft, enable auto-merge, release, or publish. Stop without writing if the exact head differs from acc0da8063bf32f54ed100430a26d3b2025bb637.

@opencode-agent address

Current head c395c0f407c5cce3cbb7cb360a7778fa78325c40 is Draft and intentionally RED. The permanent test already requires both bounded curl timeouts, while production still lacks them. Apply and delete docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch.

git apply --check docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch
git apply docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch
rm docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch
python -m pytest tests/test_security_scan_exact_head.py tests/test_security_scan_sarif_exact_head.py -q
python -m coverage erase
python -m coverage run -m pytest tests -q
python -m coverage report
python -m compileall -q tests
git diff --check

The probe must retain -o /dev/null, accept only HTTP 200, and fail closed for timeout or transport failure while bounding connection setup to 10 seconds and total execution to 30 seconds. Commit ordinary workflow source and patch deletion only. Keep Draft until exact-head quality/security/SAST/supply-chain gates, fresh automated review, zero actionable threads, and qualifying independent approval are complete. Do not weaken the only-200 rule, restore a green-skip path, force-push, merge, release, or mark Ready.

@opencode-agent The exact head is now c395c0f407c5cce3cbb7cb360a7778fa78325c40. The prior response created docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch instead of changing the required workflow, so it is not the GREEN implementation and is out of the four-line repair scope.

On this exact head, perform both operations in one commit:

1. Delete docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch completely.
2. Modify only .github/workflows/security-scan.yml by replacing the existing single curl line

curl -sS -o /dev/null -w '%{http_code}' \

with exactly

curl -sS --connect-timeout 10 --max-time 30 -o /dev/null -w '%{http_code}' \

Do not line-wrap that curl command. Preserve every other workflow byte and path. The immutable RED test commit acc0da8063bf32f54ed100430a26d3b2025bb637 and failed exact-head quality run 31147866151 remain authoritative. After the two-path correction, run the exact-head contract and all required checks. Do not create another patch/staging/documentation file. Do not modify tests, docs, changelog, other workflows, dependencies, permissions, credentials, refs, release state, or any other path. Do not merge, rebase, retarget, force-update, or enable auto-merge. Stop without writing if the head differs from c395c0f407c5cce3cbb7cb360a7778fa78325c40.

@coderabbitai autofix

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 12 minutes and 19 seconds before sending another message.

Exact current head c395c0f407c5cce3cbb7cb360a7778fa78325c40 remains intentionally RED. Security Scan Exact-Head Quality CI run 31148072206, job 92771701711, again failed only test_dependency_review_support_probe_fails_closed_unless_api_returns_200 because .github/workflows/security-scan.yml still lacks literal --connect-timeout 10 (and the same contract also requires --max-time 30).

The exact desired minimal workflow diff is already staged in docs/superpowers/patches/2026-08-07-dependency-review-timeouts.patch at this head. Apply that bounded diff to the real dependency-review curl command, then remove the staging patch from the final tree so the PR does not retain a patch artifact or competing repair mechanism. Preserve -o /dev/null, exact base/head binding, only-HTTP-200 continuation, concise body-free diagnostics, read-only permissions, immutable action pins, and every other scanner. Re-run the dependency-free exact-head contract before changing Draft state. Do not weaken the test, create a write-capable workflow, or treat the aggregate Security Scan as sufficient while this dedicated contract is RED.

@opencode-agent Perform a read-only exact-head review of e7690e359791353fb5547e1b4a4d1e4272f78cc3 against exact base e6fc91416c4fb13febd07b985c6e9c74fe888306; do not modify files, refs, PR state, or credential identities.

Verify the literal pull-request head repository/SHA checkout for dependency review, Trivy, and Scorecard; exact-head SARIF attribution; only-HTTP-200 continuation for dependency-review support; --connect-timeout 10, --max-time 30, -o /dev/null, exact base/head identity, concise body-free diagnostics, and fail-closed handling of 403/404/000/malformed/transport/timeout outcomes; immutable pins, read-only permissions, fork support, independent scanner controls, documentation, CHANGELOG, and removal of the temporary patch artifact. Security Scan Exact-Head Quality CI 31148401381, OSV 31148403002, Scorecard 31148401994, and SBOM 31148401417 succeeded on this exact head; remaining exact-head checks must complete before approval. The prior change-request review on dfa28786... was dismissed only as stale-head evidence and does not imply approval. Anchor any formal outcome to this exact head and do not merge or weaken the hard gate.

@coderabbitai review

Review only exact head e7690e359791353fb5547e1b4a4d1e4272f78cc3. The two earlier findings are now implemented test-first: body discard is positively asserted; bounded connection and total timeouts are present in the real workflow; the temporary patch artifact is absent; and both inline threads are resolved. Treat prior-head review text as stale unless reproducible on this exact tree. Focus on exact-head identity, fail-closed dependency evidence, timeout semantics, no body leakage, least privilege, immutable pins, tests, doctoring, and CHANGELOG.

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 6 minutes and 42 seconds before sending another message.

@opencode-agent @cwl-noema-review

Review-only request for exact current head e7690e359791353fb5547e1b4a4d1e4272f78cc3 against protected base e6fc91416c4fb13febd07b985c6e9c74fe888306. Do not mutate the branch, mark ready, or merge. After every currently queued/in-progress exact-head gate completes successfully, verify explicit head-repository/SHA checkout, exact SARIF ref/SHA binding, dependency-review support probing with connection and total timeouts, response-body discard, only-HTTP-200 acceptance, fail-closed 403/404/transport behavior, fork read-only support, independent scanner controls, APA 7 operator guidance, no temporary writer workflow, and zero unresolved threads. Submit a formal non-author APPROVE only when all exact-head evidence is complete and no blocker remains.

@coderabbitai review

Review only exact current head e7690e359791353fb5547e1b4a4d1e4272f78cc3. Verify the addressed timeout/body-disposal findings against the live workflow and test contract, the seven-file PR scope, exact PR-head checkout/SARIF identity, immutable action pins, only-HTTP-200 dependency-review gate, non-200/transport/timeout fail-closed behavior, response-body non-disclosure, least-privilege permissions, fork-read-only operation, and the absence of any fail-open substitute. Treat dismissed or predecessor-head reviews and checks as historical only.

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 3 minutes and 2 seconds before sending another message.

Exact-current-head read-only review request after the bounded dependency-review timeout repair.

Head: e7690e359791353fb5547e1b4a4d1e4272f78cc3. Exact-head quality, CodeQL, Python Security, Semgrep, Security Scan, Secret Scan, OSV, Scorecard, and SBOM have successful same-head runs. Both CodeRabbit findings are implemented and all inline threads are resolved. The OpenCode request-changes review is predecessor-head evidence.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Review only this exact head. Revalidate exact-head checkout/SARIF identity, the only-HTTP-200 dependency-review gate, 10-second connection and 30-second total limits, response-body discard, fail-closed timeout/transport handling, documentation, and exact-head check evidence. Do not mutate the branch, approve from the author identity, merge, alter reviewer credentials, or weaken the hard gate.

@opencode-agent @cwl-noema-review

Read-only exact-head review request for e7690e359791353fb5547e1b4a4d1e4272f78cc3. Re-evaluate the fail-closed dependency-review probe after the direct timeout/body-discard repair, current resolved review threads, and exact-head quality/security evidence. Do not mutate the branch, update its base, synthesize approval, or merge; publish only a verdict anchored to this exact head.

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 2 minutes and 26 seconds before sending another message.

Exact-current-head read-only review request after bounded dependency-review availability and response-body suppression repairs.

Head: e7690e359791353fb5547e1b4a4d1e4272f78cc3. Security Scan Exact-Head Quality CI 31148401381; CodeQL 31148588713; Python Security 31148588745; SAST 31148588750; Security Scan 31148588721; Secret Scan 31148588724; OSV 31148589040; Scorecard 31148588694; and SBOM 31148588756 are all successful on this immutable head. Every inline finding is resolved. Existing request-changes reviews are predecessor-head evidence and are dismissed.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Review only exact head e7690e359791353fb5547e1b4a4d1e4272f78cc3. Do not update the branch, approve from the author identity, merge, weaken dependency-review fail-closed behavior, or substitute another scanner for the hard gate.

Your plan includes PR reviews subject to rate limits. More reviews will be available in 29 minutes.

@opencode-agent Perform a read-only exact-head review of PR #799 at e7690e359791353fb5547e1b4a4d1e4272f78cc3 against base e6fc91416c4fb13febd07b985c6e9c74fe888306. Do not modify files, refs, PR state, credentials, or workflow permissions.

Inspect the complete seven-file diff and independently verify: exact pull-request head repository/SHA checkouts; exact base/head dependency comparison; HTTP 200 as the sole successful support result; 10-second connect and 30-second total probe deadlines; discarded response body and non-leaking diagnostics; immutable action pins; read-only/fork-compatible permissions; exact-head SARIF attribution; no fail-open or dependency-neutral substitute; quality-contract RED/GREEN evidence; documentation and CHANGELOG alignment; all exact-current-head checks and zero unresolved valid threads. Anchor any formal review to this PR and exact head. Dismissed or predecessor-head reviews are historical only. Do not merge, release, publish, or bypass independent non-author approval.