ci(security): consolidate required OSV and Scorecard scans - #1826
Conversation
Signed-off-by: Seongho Bae <me@seonghobae.me>
|
Warning Review limit reachedNext included review available in 3 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Post-merge rollout check found the source consolidation is merged at So the code-side 9→7 consolidation is not yet an operational reduction for consumers such as ConceptWeave. Keep the PR's stated rollout order: update only those two workflow entries in the existing ruleset payload, preserve the pull-request/deletion/non-fast-forward rules and remaining seven workflows, then re-read the exact live payload and consumer required checks. Until that happens, do not count #1826 as consumer GREEN or attribute queue reduction to the 7-workflow ruleset. |
) Both are required-check tests that were broken org-wide, for every PR regardless of its own diff -- reproduced fresh on unmodified main. Root causes: tests/test_central_required_workflow_exact_inventory.py: its hard-coded EXPECTED_REQUIRED_WORKFLOW_PATHS oracle still had 9 entries (including osv-scanner-pr.yml and scorecard-pr.yml). #1826 ("consolidate required OSV and Scorecard scans") intentionally shrank the production REQUIRED_WORKFLOW_PATHS tuple to 7 entries and updated its sibling test file (test_central_required_workflow_ruleset_audit.py) to match, but missed this independent-oracle file. Confirmed via docs/org-required-workflow-rollout.md and git history (git log -S) that the 7-path production state is the intentional, current design -- not a regression -- so the fix updates the stale oracle, not production. tests/test_opencode_required_verdict_regression.py: two separate gaps from #1823 ("break runner-capacity dispatch deadlock"), which replaced opencode-review.yml's old event_type:"merge-scheduler" dispatch (a minimal payload: target_repository/pr_number/base_branch/max_prs/trigger_reviews/ enable_auto_merge/etc.) with a direct event_type:"opencode-review" dispatch carrying exact base/head SHAs and a required_run_id: - test_required_workflow_cannot_succeed_with_an_echo_only_placeholder still asserted the old event_type string and two fields (trigger_reviews:true, enable_auto_merge:false) that no longer exist anywhere in the workflow. Updated to check the new event_type and required_run_id fields instead; dropped the assertion with no direct successor field. - The "Request current-head OpenCode review execution" step's env block grew three new vars (BASE_SHA, HEAD_REF, plus the always-present $GITHUB_RUN_ID) that the subprocess-harness test building this step's env by hand hadn't been updated to supply, so the script died on `set -u` before reaching the code under test. Added the three missing entries. Verified full local triad: coverage run -m pytest tests -> 2779 passed, coverage report --fail-under=100 -> 100%, interrogate -> 100%. Not fixed in this pass (separate, lower-priority prose drift, no test currently pins it): docs/org-required-workflow-rollout.md still says "9 entries... through osv-scanner-pr.yml", stale since #1826's consolidation. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
문제
조직 ruleset
18156473이security-scan.yml과 별도로osv-scanner-pr.yml,scorecard-pr.yml도 모든 대상 PR에 주입합니다.security-scan.yml은 이미 blocking OSV 비교/SARIF와 Scorecard/SARIF를 소유하므로 PR마다 workflow run 두 개와 changed-scope job 두 개가 중복됩니다.변경
security-scan.yml을 조직 OSV/Scorecard의 단일 required owner로 고정합니다..github자체 classic branch protection의 기존osv-scan / osv-scan,scorecardcontext를 계속 발행하기 위함입니다.안전한 rollout
이 PR 병합 뒤 ruleset
18156473의 기존 payload에서 다른 조건·보호 규칙·7개 workflow 항목은 그대로 두고 아래 두 항목만 제거합니다..github/workflows/osv-scanner-pr.yml.github/workflows/scorecard-pr.yml그 전에는 live ruleset을 변경하지 않습니다. 병합 직후 exact payload를 재조회하고, 대상 소비자 PR에서
Security Scan / osv-scan,Security Scan / scorecard및 전체 required workflow 결론을 확인합니다.검증
actionlint .github/workflows/security-scan.yml .github/workflows/osv-scanner-pr.yml .github/workflows/scorecard-pr.ymluv run pytest -q tests/test_central_required_workflow_ruleset_audit.py tests/test_code_scanning_required_workflow_contract.py tests/test_required_workflow_queue_contract.py— 106 passedgit diff --checkBase:
30425f6c5f2d8455e354e65484aa26819b49b376Head:
b9fdffe9