fix(osv): preserve immutable direct-source provenance - #1158
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📝 WalkthroughWalkthroughOSV 보안 스캔이 결과 증거를 분류하고, base/head 결과와 lockfile provenance를 보존합니다. 중앙 정책은 검증된 SheetJS 직접 소스 finding만 재조정합니다. 감사 기록, 회귀 테스트, 전용 품질 CI를 추가했습니다. ChangesOSV provenance 검증
Estimated code review effort: 5 (Critical) | ~90+ minutes Merge Risk: ⚪ Minimal · up to The change preserves direct-source provenance and fail-closed handling; no actionable merge-blocking risk remains. A minor documentation correction is still recommended so the documented range rules match the implemented behavior. Sequence Diagram(s)sequenceDiagram
participant SecurityScan
participant OSVScanner
participant EvidenceClassifier
participant ProvenanceReconciler
participant Reporter
SecurityScan->>OSVScanner: base/head OSV 스캔 실행
OSVScanner-->>EvidenceClassifier: 결과 파일과 scan outcome 전달
EvidenceClassifier-->>SecurityScan: complete 상태 반환
SecurityScan->>ProvenanceReconciler: 결과와 pnpm lockfile 전달
ProvenanceReconciler-->>SecurityScan: 재조정 결과와 감사 기록 저장
SecurityScan->>Reporter: results.sarif 생성 요청
Reporter-->>SecurityScan: reporter verdict 반환
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 92.59% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 54 functions across 3 files. (4 skipped: 4 unsupported.) ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent review exact current head |
|
@opencode-agent Keep this PR Draft and repair the current exact head
Also remove the self-trust exception in |
|
Revalidated PR #1158 after repairing the current-head provenance contract. Root-cause fixes:
Exact-head proof:
Please rerun independent review and all protected Checks for this exact head. The PR remains subject to branch protection; no merge is claimed. |
|
@opencode-agent review exact current head |
|
@opencode-agent review this exact current HEAD. Use the current commit SHA, current Checks, and current diff; do not reuse prior approvals or prior-head evidence. |
|
Inkspan downstream canary is ready for this existing owner lane; no consumer-side suppression/workaround has been introduced. Fresh bindings before this note:
After this exact owner repair integrates into protected |
|
Security root-cause fix at current head e2c0031: malformed UTF-8 is now rejected at the shared text-input boundary with an explicit fail-closed ValueError, covering lockfile and JSON audit/results inputs. Added regression coverage; local 15 tests, Ruff, compileall, and diff checks passed. Please run the independent current-head review and required checks for this exact SHA. |
|
@opencode-agent please review current HEAD e2c0031 for PR #1158; focus on malformed input handling, fail-closed provenance, and security regressions. |
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-direct-source-provenance.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-direct-source-provenance.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: osv_direct_source_reconcile.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: osv_direct_source_reconcile.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
e61fb11fbd5c7464d34cc8bedc3a7177fbdcade2. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32636946163/job/97188058523)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32636946163/job/97188058523)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-direct-source-provenance.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-direct-source-provenance.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: osv_direct_source_reconcile.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: osv_direct_source_reconcile.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact head |
|
@opencode-agent review Please publish an independent substantive formal Reviews API verdict for exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
88b6859f2edabfb65f2bbac32460b5341c3980c0. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32718073334/job/97403470177)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32718073334/job/97403470177)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-direct-source-provenance.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-direct-source-provenance.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: osv_direct_source_reconcile.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: osv_direct_source_reconcile.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
88b6859f2edabfb65f2bbac32460b5341c3980c0. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32718073334/job/97403470177)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32718073334/job/97403470177)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-direct-source-provenance.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-direct-source-provenance.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: osv_direct_source_reconcile.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: osv_direct_source_reconcile.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current headabada26a0aef76af82ab26ac3544f2a88a3c127d. -
Head SHA:
abada26a0aef76af82ab26ac3544f2a88a3c127d -
Workflow run: 32827248949
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-direct-source-provenance.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-direct-source-provenance.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: osv_direct_source_reconcile.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: osv_direct_source_reconcile.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (2 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (2 files)"]
R5 --> V5["targeted test run"]
Protected-main convergence — exact current headExact head The resolved tree is exactly Fresh verification on that exact tree:
This restores mergeability against live protected main without weakening the Security Scan/OSV contract. Hosted exact-head checks and a qualifying exact-current-head formal review remain authoritative before integration; no merge claim is made here. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-current-head convergence and verification (2026-08-26)
Fresh exact-head OSV, Security Scan, CodeQL, SBOM, provenance, and quality runs are queued/in progress and remain non-passing until terminal. #1096 stays open until protected-main integration and a fresh Inkspan #318 Security Scan remove the official xlsx@0.20.3 contradiction while affected and unverifiable controls remain fail-closed. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
| - name: Checkout exact central provenance policy | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| repository: ContextualWisdomLab/.github | ||
| ref: ${{ github.event.pull_request.base.repo.full_name == 'ContextualWisdomLab/.github' && github.event.pull_request.base.sha || github.workflow_sha }} | ||
| path: .cwl-trusted-security-policy | ||
| persist-credentials: false | ||
| - name: Reconcile immutable direct-source provenance | ||
| run: | | ||
| set -euo pipefail | ||
| reconciler=".cwl-trusted-security-policy/scripts/ci/osv_direct_source_reconcile.py" | ||
| audit="osv-provenance-audit.json" | ||
| if [ -L "$reconciler" ]; then | ||
| echo "::error::Trusted OSV provenance policy is a symlink; refusing an untrusted policy boundary." | ||
| exit 1 | ||
| elif [ ! -f "$reconciler" ]; then | ||
| echo "::notice::trusted provenance policy is not yet present; retaining raw OSV evidence without reconciliation." | ||
| else | ||
| base_lock="$RUNNER_TEMP/osv-base-provenance/pnpm-lock.yaml" | ||
| if [ -f "$base_lock" ]; then | ||
| python3 "$reconciler" \ | ||
| --results old-results.json \ | ||
| --lockfile "$base_lock" \ | ||
| --source-path source/pnpm-lock.yaml \ | ||
| --audit "$audit" \ | ||
| --label base | ||
| fi | ||
|
|
||
| if [ -L source/pnpm-lock.yaml ]; then | ||
| echo "::error::Head pnpm-lock.yaml is a symlink; direct-source provenance is not authoritative." | ||
| exit 1 | ||
| fi | ||
| if [ -f source/pnpm-lock.yaml ]; then | ||
| python3 "$reconciler" \ | ||
| --results new-results.json \ | ||
| --lockfile source/pnpm-lock.yaml \ | ||
| --source-path source/pnpm-lock.yaml \ | ||
| --audit "$audit" \ | ||
| --label head | ||
| fi | ||
| fi |
There was a problem hiding this comment.
📝 Info: Reconciler no-ops on the central repo's own PR run
The policy checkout resolves to base.sha for ContextualWisdomLab/.github PRs (security-scan.yml:351). This PR adds the reconciler, so base main lacks it and the reconcile step takes the [ ! -f "$reconciler" ] notice branch, retaining raw OSV evidence. This is the intended pull_request_target model (run the base branch's trusted script), so reconciliation cannot exercise itself on this PR's own CI.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Tracks #1096; do not close until protected-main integration and fresh Inkspan canary acceptance.
Outcome
The reusable Security Scan preserves direct-tarball URL, integrity, version, package identity, and scanner-source provenance before deciding whether an npm advisory applies.
xlsxreleases, including 0.18.x, 0.19.2, and 0.20.1, remain findings.xlsx@0.20.3evidence outside the authoritative affected range is reconciled.SCANNER_METADATA_CONFLICT.source.path.Exact current identity
abada26a0aef76af82ab26ac3544f2a88a3c127dmain@8fd471a31399a914d9cb22a840f4a4c68e010ea6649a1ef268476d24b8d8f1483c8af6b5c8d40ea1exactly matched an independent localgit merge-tree --write-treeVerification
Exact-head local:
python3 -m unittest -v tests.test_osv_direct_source_reconcile: 20/20 passedSCANNER_METADATA_CONFLICTgit diff --check: PASSHosted exact-head runs checked out
abada26…. The OSV and Strix quality paths are currently non-passing because their full central suite reported 2 stale predecessor assertions out of 1,431 tests: both still expect retiredgpt-5.6-lunawhile the protected workflow emitsgpt-5.4. That contract defect is already repaired on canonical owner #1320; it is not an OSV source finding and is intentionally not duplicated here.Integration acceptance
After #1320 and this repair integrate through normal governance, rerun Security Scan on the current Inkspan #318 head. Acceptance requires the official immutable
xlsx@0.20.3contradiction to disappear while affected and unverifiable controls remain fail-closed.No consumer source or protected branch was changed.
Summary by CodeRabbit
보안 및 품질 개선
문서