fix(security): fail closed on unavailable dependency review - #897
fix(security): fail closed on unavailable dependency review#897seonghobae wants to merge 6 commits into
Conversation
|
Warning Review limit reached
Next review available in: 55 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughdependency-review 게이트가 exact base/head 비교의 HTTP 200 증거만 허용하도록 변경되었습니다. 오류, 빈 응답, 부분 전송, 비정상 상태 코드는 실패 처리합니다. PR head checkout, 회귀 계약 테스트, 운영 문서를 갱신했습니다. Changes공급망 검증 제어
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The dependency-review gate is changed to fail closed when comparison evidence is unavailable, and no actionable merge-blocking risk remains in the supplied evidence beyond normal checks and review. Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant security_scan
participant GitHubCompareAPI
participant dependency_review
PullRequest->>security_scan: PR head repository와 head SHA 전달
security_scan->>GitHubCompareAPI: 정확한 base...head 비교 요청
GitHubCompareAPI-->>security_scan: HTTP 상태와 전송 결과 반환
security_scan->>dependency_review: 전송 코드 0 및 HTTP 200일 때 실행
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/oc Refetch and abort unless exact head is still Fix test-first on this existing branch only. Add a permanent regression that models a fake/controlled curl which writes HTTP Strengthen |
|
Exact-head RCA and proof for
Hosted exact-head security and supply-chain results remain authoritative. |
|
@opencode-agent review Evaluate exact current head |
|
Follow-up at current head |
|
@opencode-agent review Review exact current head |
|
@coderabbitai review Review exact current head |
|
I will verify the dependency-review fail-closed boundary and the listed workflow invariants. I will keep exact-head check evidence separate from review judgment, approval, and merge authority. I will not modify code, merge, or change protections. I used the repository guidance that only successful checks for the exact current head are valid merge evidence. 🧠 Learnings used
|
|
Exact-current-head review request for Review the bounded six-file supply-chain evidence repair: dependency-review support accepts only HTTP 200; non-200, timeout, or unavailable comparison fails closed with exact identity and operator guidance; response bodies are discarded; checkout is bound to the explicit PR head repository/SHA; and read-only permissions plus immutable action pins remain. Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation are terminal-success on this exact head. No review thread exists. Keep the exact head unchanged. Do not update the branch, synthesize author approval, substitute another scanner for dependency-review evidence, add credentials, merge, release, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Re-evaluate exact current head |
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review Please provide an independent exact-head review of |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
Pull request was converted to draft
|
Returned to Draft because this branch overlaps the authoritative prerequisite #821 and no longer matches its own four-file bounded-scope claim. #821 already owns the fail-closed dependency-review boundary and exact-head focused quality gate. This branch contains a useful incremental refinement—capturing the After #821 reaches protected |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review After a qualifying exact-head OpenCode verdict, independently review |
|
@opencode-agent review exact head |
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Replay unique #897 source onto current origin/main. Skip shared ARCHITECTURE/CLAUDE trees. Treat non-200 or failed transport as unavailable evidence rather than a clean skip.
d6bb469 to
b2d19cc
Compare
|
Exact-head lock repair pushed as ef3d210 from b2d19cc. Updated the hashed pip audit runtime from pip 26.1.2 to pip 26.2.1 with exact hashes. The same lock has passed local pip-audit in this maintenance loop; hosted checks and exact-head approval must be re-evaluated. No bypass or force push was used. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
opencode-agent
Bot
added
area: dependencies
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough보안 스캔 워크플로가 정확한 PR revision을 checkout하고 SHA를 검증합니다. dependency-review는 curl 전송 성공과 HTTP 200을 모두 요구하는 fail-closed 게이트로 변경되었습니다. Trivy와 Scorecard SARIF 업로드에도 PR head 정보를 고정했습니다. 관련 문서와 계약 테스트를 갱신했습니다. Changes공급망 검증 제어
Estimated code review effort: 4 (Complex) | ~45 minutes Merge Risk: ⚪ Minimal · up to The change makes dependency review fail closed when required comparison evidence is unavailable, with no actionable merge-blocking risk remaining after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant SecurityScan
participant GitHubCompareAPI
participant DependencyReview
participant SARIFUpload
PullRequest->>SecurityScan: head repository와 immutable head SHA 제공
SecurityScan->>GitHubCompareAPI: 정확한 base/head 비교 요청
GitHubCompareAPI-->>SecurityScan: curl 상태와 HTTP 상태 반환
SecurityScan->>DependencyReview: 두 상태가 성공이면 dependency-review 실행
SecurityScan->>SARIFUpload: PR head ref와 SHA로 결과 업로드
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
#1222 exact-head Security owner update Exact current head: TDD evidence:
The workflow now explicitly materializes and attests immutable OSV base/head revisions; binds Dependency Review, Trivy, and Scorecard to the submitted head repository/SHA; supplies exact base/head refs to the pinned Dependency Review action; and binds all Security SARIF uploads to Current hosted workflows are new-head queued/in-progress and are not counted as passing. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head update for
Hosted checks and a substantive formal Reviews API verdict must be regenerated for this exact head. Keep #1222 open until protected-main integration and a fresh ScopeWeave #523 canary records the actual Security checkout SHA equal to its exact contributor head. @opencode-agent review this exact head only. Review-only: do not mutate branches, merge state, rulesets, or releases. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head permission-contract repair for #1222 / #810:
Every head-oriented Security checkout remains bound and runtime-attested to the submitted PR head, and OSV remains explicitly dual-revision. Hosted exact-head checks and a substantive exact-head formal verdict must regenerate; predecessor evidence is non-passing. @opencode-agent review this exact head only. Review-only; do not mutate or merge the branch. |
|
Exact-head review handoff for The two current informational threads are now dispositioned against the live required-workflow contract and resolved:
All 12 substantive exact-head hosted workflows are successful, with only the unrelated repair workflow skipped; unresolved threads are zero. No exact-current-head formal Reviews API verdict exists yet. @opencode-agent review Review-only request: inspect the exact-head binding and fail-closed dependency-evidence boundary and submit a substantive formal verdict for this SHA. |
|
Protected-main synchronization moved the exact head to @opencode-agent review |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
d9b395cd01999a6ec946d3c7a013f22225143782. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97179798282)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97179798282)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
d9b395cd01999a6ec946d3c7a013f22225143782. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97191695465)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97191695465)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
1 participant
Purpose
Replace the stale, conflicted #799 integration path with a bounded current-main repair for #810. Preserve #799 as historical evidence only; do not import its divergent removal of later Strix work.
Root cause
The central required
Security Scancould conclude success when the exact dependency-review comparison returned HTTP 403 or 404. The support probe emittedsupported=false, exited zero, and skipped the pinned Dependency Review action. A hard supply-chain evidence boundary had therefore been modeled as an optional capability optimization.Remedy and TDD identity
6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;b06bb25c1af99b784730209dceb299cd493734f7reverses the stale fail-open queue contract;71947d24828cfb42806f5ef0a8abf83f9279d0afaccepts only HTTP 200, preserves curl transport status separately, bounds connect/total time, discards the response body, checks out the explicit PR-head repository/SHA, and emits exact-identity failure evidence;b527192d7b758fc2f8a95545f25545cec7747c99proves a partial transfer that prints200but exits non-zero cannot pass;59d702f30fa419a016e24c18e87e05c76fbee4a3;Scope correction
Unrelated scheduler-secret and Python-lock-materializer source/test changes that had accumulated on this branch were removed. Flattening an include-bearing requirements lock under a generated filename does not preserve relative include targets and requires a separately designed, test-first path-preservation contract.
The final scope changes only the Dependency Review control plane and its durable architecture, operator, release-note, and workflow-contract evidence. The existing executable mode of
scripts/ci/materialize_base_python_requirements.pyis preserved; the final mode-only correction introduces no source-content change.Acceptance contract
Merge only after:
After merge, require a protected-main public-repository consumer run proving a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate before closing #810.
Summary by CodeRabbit
보안 강화
문서
테스트