chore(security): unify OSV Action v2.5.1 - #1276
Conversation
|
Warning Review limit reachedNext included review available in 29 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughOSV-Scanner 관련 워크플로 참조를 v2.5.1 커밋으로 통일했습니다. 버전 고정 정책과 변경 기록을 문서화하고, 모든 참조의 SHA·태그·컴포넌트 개수를 검증하는 테스트를 추가했습니다. ChangesOSV-Scanner 버전 고정
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🔵 Low · up to The PR updates the OSV-Scanner Actions to v2.5.1, but nearby workflow notes remain inconsistent with that version and the provenance record uses a future-dated search date, which can mislead operators and weaken audit traceability. The change is mergeable with explicit owner follow-up on these bounded documentation issues. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Implemented on exact head . The OSV pin contract now scans both and workflow files and only treats lines containing as action references, avoiding comment false positives. Targeted contract test passed; passed. |
|
Implemented on exact head 5b14089. The OSV pin contract now scans both yml and yaml workflow files and only treats lines containing uses as action references, avoiding comment false positives. Targeted contract test passed. git diff check passed. |
|
Exact-head RCA for 5b14089: the source and action-contract checks passed, but Strix run 32689043516 failed closed after NVIDIA NIM provider infrastructure output and the protected-base openai-direct fallback alias was rejected by LiteLLM. No source vulnerability finding was produced. This dependency PR remains behind the provider-repair stack and cannot merge until a current-base exact-head Strix result and independent review are available. |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
26187df510898277f8bf6f0e98b7d5e53c41abd1. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32717334432/job/97401266766)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32717334432/job/97401266766)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-scanner-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-scanner-action-single-version.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_osv_scanner_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_osv_scanner_action_pin_contract.py"]
R4 --> V4["targeted test run"]
OpenCode Review Overview
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
26187df510898277f8bf6f0e98b7d5e53c41abd1. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32717334432/job/97401266766)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32717334432/job/97401266766)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: osv-scanner-action-single-version.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: osv-scanner-action-single-version.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_osv_scanner_action_pin_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_osv_scanner_action_pin_contract.py"]
R4 --> V4["targeted test run"]
# Conflicts: # CHANGELOG.md
|
Refreshed on current main at exact head e5282ed. Upstream tag v2.5.1 resolves directly to verified commit |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
e5282ed74341efe122eb512cfef243a7bd7270bc. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33194687214/job/98930282203)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33194687214/job/98930282203)
- strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33194986907)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: osv-scanner-pr.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: osv-scanner-pr.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: security-scan.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: security-scan.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
R3 --> V3["required checks"]
Evidence --> S4["Docs: osv-scanner-action-single-version.md"]
S4 --> I4["operator or user guidance"]
I4 --> R4["Review risk: Docs: osv-scanner-action-single-version.md"]
R4 --> V4["docs review"]
Evidence --> S5["Test: test_osv_scanner_action_pin_contract.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_osv_scanner_action_pin_contract.py"]
R5 --> V5["targeted test run"]
…ion-v2.5.1-unified-20260824 # Conflicts: # CHANGELOG.md
Document this hourly cycle's org-wide Strix root-cause finding (fixed by this same branch), plus PR #1233/#1275/#1276 merge-conflict resolution, #1274 closure as superseded by #1307, and the unrelated pre-existing scripts/ci/pingora_edge_policy.py coverage-gap finding, per the dated continuation-entry convention already used in this file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
4cffcf669ce152ccd01b241cc1c8991efa619ceb. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/33311428556/job/99257073412)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/33311428556/job/99257073412)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: osv-scanner-pr.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: osv-scanner-pr.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Workflow: security-scan.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: security-scan.yml"]
R2 --> V2["actionlint plus required checks"]
Evidence --> S3["Repository file: CHANGELOG.md"]
S3 --> I3["repository behavior"]
I3 --> R3["Review risk: Repository file: CHANGELOG.md"]
R3 --> V3["required checks"]
Evidence --> S4["Docs: osv-scanner-action-single-version.md"]
S4 --> I4["operator or user guidance"]
I4 --> R4["Review risk: Docs: osv-scanner-action-single-version.md"]
R4 --> V4["docs review"]
Evidence --> S5["Test: test_osv_scanner_action_pin_contract.py"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test: test_osv_scanner_action_pin_contract.py"]
R5 --> V5["targeted test run"]
|
Superseded by newer upstream evidence and current-main ownership. This branch correctly discovered that scanner/reporter/reusable OSV uses must be version-locked together, but it pins them to official v2.5.1 commit |
2 participants
Outcome
Pins all four central OSV-Scanner Action uses to the full commit referenced by the official current v2.5.1 tag. This clean current-main replacement supersedes stale Draft #921, whose v2.5.0 target is no longer current.
Supersedes #921.
Verification
Provenance
The official
v2.5.1tag resolves to6e4298ebc4db23e847df9b2e2de2939d6f066c67. The doctoring record cites the official release and GitHub immutable-SHA guidance in APA 7th form.Summary by CodeRabbit
버그 수정
문서
테스트