fix(security): bind repository scanners to exact PR head - #799
fix(security): bind repository scanners to exact PR head#799seonghobae wants to merge 26 commits into
Conversation
|
Warning Review limit reached
Next review available in: 4 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthroughPR의 실제 head 저장소와 SHA를 보안 스캔 입력과 SARIF 식별자에 고정했습니다. Dependency Review API는 HTTP 200에서만 성공하며, 관련 계약 테스트와 quality CI를 추가했습니다. 운영 계약과 rollback 절차도 문서화했습니다. ChangesExact-head 보안 스캔
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant DependencyReviewAPI
participant Trivy
participant Scorecard
participant SARIFUpload
PullRequest->>GitHubActions: head repository와 head SHA 제공
GitHubActions->>DependencyReviewAPI: base SHA와 head SHA 비교 요청
DependencyReviewAPI-->>GitHubActions: HTTP 200 또는 실패 상태 반환
GitHubActions->>Trivy: head repository와 head SHA checkout
GitHubActions->>Scorecard: head repository와 head SHA checkout
Trivy->>SARIFUpload: head ref와 head SHA를 포함한 SARIF 업로드
Scorecard->>SARIFUpload: head ref와 head SHA를 포함한 SARIF 업로드
Possibly related issues
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent Extend this exact-current-head security-scan repair test-first to address #810, and do nothing if PR #799 branch head is no longer A downstream exact-head canary exposed a valid organization-level fail-open defect in the same workflow. Use two auditable commits in order:
Update doctoring so its claimed fail-closed behavior matches production and include current APA 7 primary references to GitHub Dependency Review, Dependency Graph, and Dependency Review REST API. Add one concise Do not change After GREEN, run the focused dependency-free contract and the complete central Python test/100% statement+branch coverage/public-docstring/compile contract available on the branch. Then leave PR #799 unmerged and request fresh exact-GREEN CodeRabbit/OpenCode/Noema review plus every required security workflow; do not claim queued, absent, skipped, predecessor-head, or synthetic-merge evidence as current-head success. Report immutable RED and GREEN SHAs in this PR conversation. |
|
@opencode-agent Extend this existing security-scan repair test-first on exact current head Fresh downstream evidence from Use the existing PR #799 rather than creating a competing PR because it already owns Required RED → GREEN extension:
Modify only the already-owned PR #799 security-scan workflow/contract/helper/documentation/CHANGELOG surface needed for this repair. Do not add any repository-write, OIDC, branch/ref publication, PR creation/merge, release/package/signing authority, temporary write-capable workflow, self-modifying workflow, model-modified-tree publication, or conflict strategy. Do not merge or mark Ready. After GREEN, require fresh exact-current-head central quality/security/review evidence and preserve independent non-author approval and branch protection as mandatory gates. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
protected_main='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
printf '%s\n' '== Current commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit exists =='
git rev-parse "${requested_head}^{commit}"
printf '%s\n' '== Requested protected commit exists =='
git rev-parse "${protected_main}^{commit}"
printf '%s\n' '== Merge base =='
git merge-base "$protected_main" "$requested_head"
printf '%s\n' '== Changed files =='
git diff --name-status "$protected_main" "$requested_head"
printf '%s\n' '== Workflow outline =='
ast-grep outline .github/workflows/security-scan.yml --items all || true
printf '%s\n' '== Focused test candidates =='
fd -t f 'security.*scan.*exact.*head|exact.*head.*security.*scan|security.*scan.*dependency.*review' tests . 2>/dev/null || true
printf '%s\n' '== Workflow security-sensitive lines =='
rg -n -C 4 --glob '.github/workflows/security-scan.yml' \
'actions/checkout|dependency-review-action|upload-sarif|head\.repo|head\.sha|refs/pull|persist-credentials|permissions:|security-events|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity' .Length of output: 2385 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
for file in \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
do
printf '\n== %s ==\n' "$file"
nl -ba "$file"
done
printf '\n== Complete diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.mdLength of output: 1191 🏁 Script executed: #!/bin/bash
set -u
base='f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae'
head='aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae'
print_file() {
file="$1"
printf '\n== %s ==\n' "$file"
if command -v awk >/dev/null 2>&1; then
awk '{ printf "%6d %s\n", NR, $0 }' "$file"
else
cat "$file"
fi
}
for file in \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
do
print_file "$file"
done
printf '\n== Complete scoped diff ==\n'
git diff --no-ext-diff --unified=80 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md || trueLength of output: 65118 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
--jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'
printf '%s\n' '== Check runs for the requested head =='
gh api "repos/${repo}/commits/aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url}'
printf '%s\n' '== Workflow-run conclusions for the requested head =='
gh run list --repo "$repo" \
--commit aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae \
--limit 100 \
--json databaseId,name,status,conclusion,event,headSha,url \
--jq '.[] | {databaseId, name, status, conclusion, event, headSha, url}'Length of output: 23567
Finding — P1: dependency-review can succeed without dependency-review evidence In Treat unavailable support as unavailable security evidence. Fail the job with a concise error that identifies the repository and exact base/head. Do not print the response body. This behavior is relevant to the reported EgressWeave public-repository The remaining requested controls are present:
I cannot approve while the dependency-review fail-open path remains.
|
|
Review-only request for exact current head |
|
@cwl-noema-review Independently review exact current head |
|
@coderabbitai review Final read-only exact-head review for |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact head |
|
@cwl-noema-review review Independently review exact head |
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
aee317b to
323c07b
Compare
|
@opencode-agent Exact-head correction for #810: extend only current PR #799 head Preserve the existing exact-PR-head checkout/SARIF binding repair. Add the dependency-review availability repair test-first in two auditable commits:
Keep exact Do not add or use a temporary/self-modifying/write-capable workflow, |
|
Review-only exact-head request for |
|
@cwl-noema-review Independently review exact head |
|
@coderabbitai review Final read-only review for exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
head='323c07b794d11f82c04db91544bc3a3f5cf5ad5c'
printf '%s\n' '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus \
--jq '{number, headRefOid, baseRefOid, isDraft, mergeStateStatus}'
printf '%s\n' '== Local checked-out commit =='
git rev-parse HEAD
printf '%s\n' '== Requested commit =='
git rev-parse "${head}^{commit}"
printf '%s\n' '== Changed files against PR base =='
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
git diff --name-status "$base" "$head"
printf '%s\n' '== Workflow structure =='
ast-grep outline .github/workflows/security-scan.yml --items all || true
printf '%s\n' '== Exact-head and policy-sensitive workflow lines =='
rg -n -C 5 \
'actions/checkout|dependency-review-action|upload-sarif|head\.repo\.full_name|head\.sha|refs/pull|persist-credentials|permissions:|security-events:|contents:|pull-requests:|trivy|scorecard|severity|fail-on-severity|BASE_SHA|HEAD_SHA|supported=' \
.github/workflows/security-scan.yml
printf '%s\n' '== Focused contract test candidates =='
fd -t f 'test_security_scan_exact_head.py|test_security_scan_sarif_exact_head.py|test_security_scan_dependency_review.py' tests 2>/dev/null \
| sort \
| xargs -r -n1 sh -c 'echo "== $0 =="; sed -n "1,260p" "$0"'
printf '%s\n' '== Scoped documentation and changelog changes =='
git diff --no-ext-diff --unified=50 "$base" "$head" -- \
.github/workflows/security-scan.yml \
.github/workflows/security-scan-exact-head-quality-ci.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_security_scan_dependency_review.py \
docs/doctoring/security-scan-exact-head.md \
CHANGELOG.md
printf '%s\n' '== Check runs for requested head =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url}'
printf '%s\n' '== Workflow runs for requested head =='
gh run list --repo "$repo" --commit "$head" --limit 100 \
--json databaseId,name,status,conclusion,event,headSha,url \
--jq '.[] | {databaseId,name,status,conclusion,event,headSha,url}'Length of output: 58020
Finding — P1: dependency-review can pass without dependency-review evidence In The exact head still contains the EgressWeave fail-open path from the prior review. Treat The requested exact-head controls are present:
I cannot approve while the dependency-review fail-open path remains. You are interacting with an AI system. |
|
Supersede the immediately preceding review-only request at issue comment Current-head inspection still shows After a new exact GREEN head implements #810, request fresh CodeRabbit/OpenCode/Noema review and every required quality/security/supply-chain workflow against that new SHA only. Predecessor-head success and this superseded review request are stale evidence. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heada6cd746e86c07452d03e0f5cef8e8d13c22f28c6. -
Head SHA:
a6cd746e86c07452d03e0f5cef8e8d13c22f28c6 -
Workflow run: 31153541779
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file (2 files)"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file (2 files)"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: security-scan-exact-head.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: security-scan-exact-head.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test (2 files)"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test (2 files)"]
R4 --> V4["targeted test run"]
|
@opencode-agent Perform a read-only formal review of exact current head |
|
@opencode-agent Review exact current head |
|
@cwl-noema-review Review exact current head |
|
/oc Refetch the live pull request and stop without writing unless its exact head is Apply the minimum test-only repair. Rename that test to describe fail-closed dependency-review evidence. Preserve assertions for Run that focused test first, then |
|
@opencode-agent review Re-read the exact current head and submit a formal review-only verdict for literal PR-head repository/SHA checkout in dependency review, Trivy, and Scorecard; exact SARIF ref/SHA binding; fork read-only compatibility; unchanged scanner severity/finding policy; least privilege; and every direct exact-head quality/security/supply-chain Check. Do not mutate or merge. |
|
@coderabbitai full review Perform a fresh exact-current-head review of literal PR-head scanner checkouts, SARIF identity, fork read-only compatibility, and unchanged scanner policy. Submit the verdict without mutating or merging. |
|
|
|
Submit a formal current-head GitHub review after the current checks settle. Approve only if all exact-head checks succeed and no actionable finding remains; otherwise post the concrete blocker. Do not mutate or merge. |
|
Please submit the formal current-head review conclusion after the latest exact-head checks complete. Do not mutate or merge. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
echo '== PR identity =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,url \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,url}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
echo '== Materialized commit identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'live-head: '; printf '%s\n' "$head"
printf 'live-base: '; printf '%s\n' "$base"
printf 'merge-base: '; git merge-base "$base" "$head"
echo '== Changed paths =='
git diff --name-status "$base" "$head"
echo '== Required exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {
name, status, conclusion, head_sha,
details_url
}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {path,line,author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}'
echo '== Dependency-review contract and scanner identity controls =='
rg -n -C 6 \
'dependency_review_support|if \[ "\$status" != "200" \]|supported=false|supported=true|connect-timeout|max-time|-o /dev/null|BASE_SHA|HEAD_SHA|dependency-review-action|head\.repo\.full_name|head\.sha|persist-credentials|upload-sarif|refs/pull' \
.github/workflows/security-scan.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_required_workflow_queue_contract.py
echo '== Scoped diff =='
git diff --no-ext-diff --unified=40 "$base" "$head" -- \
.github/workflows/security-scan-exact-head-quality-ci.yml \
.github/workflows/security-scan.yml \
CHANGELOG.md \
README.md \
docs/doctoring/security-scan-exact-head.md \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_required_workflow_queue_contract.pyLength of output: 87268
I cannot approve this head. P1 — The central test contract still asserts the removed fail-open behavior.
The live Replace the stale test with a fail-closed contract that requires:
The reviewed production controls are otherwise correct on this exact head:
The current successful checks are valid execution evidence. They do not correct the stale central test contract. You are interacting with an AI system. |
|
@opencode-agent review Use the newest exact head only. If every required check is green and there is no actionable finding, submit formal approval; otherwise state the blocker. Do not mutate or merge. |
|
@cwl-noema-review review Use exact-current-head evidence only. Approve formally only when required checks are green and no actionable finding remains; otherwise identify the blocker. Do not mutate or merge. |
|
@opencode-agent review Do not post another top-level acknowledgement. Submit the formal exact-head review verdict through the GitHub review API when current-head checks are complete; approve only if no blocker remains. Do not mutate or merge. |
|
@coderabbitai full review Use the exact current head only and submit the review verdict through the formal GitHub review surface; do not post another summary comment, mutate, or merge. |
Rate Limit Exceeded
|
|
@cwl-noema-review Please use the GitHub review API rather than another comment for the final exact-head verdict. Do not mutate or merge. |
|
Final action expected: use the GitHub review API for the exact current head. Approve only if current required checks are successful and no actionable finding remains; otherwise post one concrete blocking review. Do not mutate or merge. |
|
@cwl-noema-review Submit one formal exact-current-head review through GitHub's review API. Do not add another discussion comment, mutate, or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
@cwl-noema-review Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
|
Do not acknowledge. Submit exactly one formal review on the exact current head through GitHub's review API after checks complete. Do not mutate or merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
P1 — The central test contract still requires the removed fail-open path.
tests/test_required_workflow_queue_contract.py, Lines 829-838, defines test_security_scan_skips_dependency_review_when_dependency_graph_is_unavailable. It requires "$status" = "403" and "$status" = "404" in .github/workflows/security-scan.yml.
The reviewed workflow correctly accepts only HTTP 200. It fails the dependency-review job for every other status. The test contract therefore contradicts the fail-closed dependency-review boundary and can fail the complete central suite.
Replace the stale test with a fail-closed contract. Require id: dependency_review_support, the exact /dependency-graph/compare/${BASE_SHA}...${HEAD_SHA} endpoint, if [ "$status" != "200" ]; then, the HTTP ${status:-unavailable} diagnostic, and supported=true only after the failing branch. Require the immutable actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 action to remain gated by the positive output. Reject supported=false and the green skip path.
The other reviewed exact-head controls are present: explicit PR-head repository/SHA checkout with persisted credentials disabled; 10-second connection and 30-second total probe timeouts; response-body discard; fail-closed non-200 outcomes; exact-head Trivy and Scorecard SARIF binding; immutable action pins; read-only fork-compatible permissions; and unchanged Trivy hard-gate and Scorecard soft-role policy.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
echo '== Pull request identity =='
gh pr view "$pr" --repo "$repo" \
--json number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,url \
--jq '{number,state,isDraft,headRefOid,baseRefOid,mergeStateStatus,url}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid)"
echo '== Materialized identity =='
printf 'checked-out: '; git rev-parse HEAD
printf 'live-head: '; printf '%s\n' "$head"
printf 'live-base: '; printf '%s\n' "$base"
printf 'merge-base: '; git merge-base "$base" "$head"
echo '== Check runs for live head =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" --paginate \
--jq '.check_runs[] | {name,status,conclusion,head_sha,details_url}'
echo '== Unresolved review threads =='
gh api graphql -F owner='ContextualWisdomLab' -F name='.github' -F number="$pr" -f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
reviewThreads(first: 100) {
nodes {
isResolved
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest.reviewThreads.nodes[]
| select(.isResolved == false)
| {path,line,author:.comments.nodes[0].author.login,body:.comments.nodes[0].body}'
echo '== Dependency-review and scanner identity controls =='
rg -n -C 6 \
'dependency_review_support|if \[ "\$status" != "200" \]|supported=false|supported=true|connect-timeout|max-time|-o /dev/null|BASE_SHA|HEAD_SHA|dependency-review-action|head\.repo\.full_name|head\.sha|persist-credentials|upload-sarif|refs/pull' \
.github/workflows/security-scan.yml \
tests/test_security_scan_exact_head.py \
tests/test_security_scan_sarif_exact_head.py \
tests/test_required_workflow_queue_contract.py
echo '== Changed paths =='
git diff --name-status "$base" "$head"Length of output: 48293 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='799'
head='a6cd746e86c07452d03e0f5cef8e8d13c22f28c6'
live_head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
if [ "$live_head" != "$head" ]; then
echo "Refusing to submit review: live head is ${live_head}, expected ${head}." >&2
exit 1
fi
body=$(cat <<'EOF'
**P1 — The central test contract still requires the removed fail-open path.**
`tests/test_required_workflow_queue_contract.py`, Lines 829-838, defines `test_security_scan_skips_dependency_review_when_dependency_graph_is_unavailable`. It requires `"$status" = "403"` and `"$status" = "404"` in `.github/workflows/security-scan.yml`.
The reviewed workflow correctly accepts only HTTP `200`. It fails the `dependency-review` job for every other status. The test contract therefore contradicts the fail-closed dependency-review boundary and can fail the complete central suite.
Replace the stale test with a fail-closed contract. Require `id: dependency_review_support`, the exact `/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}` endpoint, `if [ "$status" != "200" ]; then`, the `HTTP ${status:-unavailable}` diagnostic, and `supported=true` only after the failing branch. Require the immutable `actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294` action to remain gated by the positive output. Reject `supported=false` and the green skip path.
The other reviewed exact-head controls are present: explicit PR-head repository/SHA checkout with persisted credentials disabled; 10-second connection and 30-second total probe timeouts; response-body discard; fail-closed non-200 outcomes; exact-head Trivy and Scorecard SARIF binding; immutable action pins; read-only fork-compatible permissions; and unchanged Trivy hard-gate and Scorecard soft-role policy.
EOF
)
gh api --method POST "repos/${repo}/pulls/${pr}/reviews" \
-f "commit_id=${head}" \
-f 'event=REQUEST_CHANGES' \
-f "body=${body}" \
--jq '{id,state,commit_id,html_url}'Length of output: 2365
You are interacting with an AI system. |
2 participants
Purpose
Restore exact-head security evidence for organization-required repository scanners and fail closed when dependency-review evidence is unavailable. DiskSage PR #137 exposed synthetic-merge scanner input; the public EgressWeave canary exposed a separate fail-open path where HTTP 403 skipped dependency review while the aggregate Security Scan remained green.
Exact current stack
a6cd746e86c07452d03e0f5cef8e8d13c22f28c6;e71fdab2ab088001f218765ecb5e3b7fabfee11a;Implemented boundary
refs/pull/<number>/headand that same exact head SHA.000, empty/malformed status, and every unexpected outcome fail closed./dev/null; diagnostics expose only bounded repository, base/head identity, and status evidence.actions/dependency-review-actionhard gate; no greensupported=falsepath exists.Exact-head acceptance evidence
For
a6cd746e86c07452d03e0f5cef8e8d13c22f28c6, all exact-head workflows completed successfully:31153100905;31153100932;31153100875;31153100955;31153100913;31153100874;31153101198;31153100952;31153100999;All inline review threads are resolved or outdated; zero actionable unresolved thread remains. Formal exact-current-head OpenCode/Noema review and a qualifying independent non-author approval remain required. Queued, cancelled, predecessor-head, synthetic-merge, status-only, author-only, local-only, or repair-workflow evidence is not accepted.
Stack order
This scanner repair overlaps the fail-closed dependency-review subset carried by
.github#813, whose primary purpose is the OpenCode fatal-process-group prerequisite. Keep this PR Draft until #813 reaches protectedmain. Then rebase or merge the new protected base, remove any base-identical overlap from the effective diff, and regenerate every exact-head quality, security, review, and approval surface. No evidence transfers across that base change.Operator and merge contract
For a public GitHub.com repository, unavailable dependency-review evidence is a repository/organization configuration or capability problem until proven otherwise. Correct dependency graph, GitHub security capability, organization policy, entitlement, or token access and rerun; do not manufacture a green check by weakening the hard gate. Private/internal exceptions require explicit organization policy and independently reviewable entitlement evidence.
docs/doctoring/security-scan-exact-head.mdrecords exact-head authorization, SARIF identity, fail-closed behavior, bounded execution, rollback, operator remediation, and APA 7 primary sources. After #813 integration and this PR's base refresh, merge only after exact-current-head automated review, qualifying independent non-author approval, zero unresolved valid findings, and every branch-protection rule succeed without bypass.