From 889287e700a0deed11e6d17e09e6515bbf40a14c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 13 Sep 2026 19:47:43 +0900 Subject: [PATCH 1/2] fix(changed-scope): cover every scannable dependency manifest in the deps allowlist Strix (MEDIUM, CVSS 4.3) on .github#2143: `osv-scan` and `dependency-review` run only when the changed-scope classifier restores `deps=true`, and that happened only for a closed list of filenames. A dependency added through Gemfile.lock, Pipfile.lock, composer.lock, poetry.lock, packages.lock.json, mix.lock, pubspec.lock, go.work and other manifests or lockfiles skipped both supply-chain gates while trivy-fs (ignore-unfixed, MEDIUM floor) was the only backstop. Extend the allowlist -- identically in the three byte-identical classifier copies -- to every lockfile osv-scanner v2.5.1 documents plus the manifests the dependency graph reads, and pin the set in a contract test that also rejects drift between the copies. The finding's "root-level files are missed" claim is incorrect (bare names were already listed) and is not part of this change. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/sast-semgrep.yml | 2 +- .github/workflows/security-scan.yml | 2 +- .github/workflows/strix.yml | 2 +- ...ged_scope_dependency_manifest_allowlist.py | 62 +++++++++++++++++++ 4 files changed, 65 insertions(+), 3 deletions(-) create mode 100644 tests/test_changed_scope_dependency_manifest_allowlist.py diff --git a/.github/workflows/sast-semgrep.yml b/.github/workflows/sast-semgrep.yml index 12b7013da3..ed14bc1420 100644 --- a/.github/workflows/sast-semgrep.yml +++ b/.github/workflows/sast-semgrep.yml @@ -89,7 +89,7 @@ jobs: *) code=true ;; esac case "$changed_path" in - requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION) deps=true ;; + requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; esac done <<<"$changed" else diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 500e22b4ab..cf1be23bf5 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -112,7 +112,7 @@ jobs: *) code=true ;; esac case "$changed_path" in - requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION) deps=true ;; + requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; esac done <<<"$changed" else diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index f15b29f564..c01659ba19 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -171,7 +171,7 @@ jobs: *) code=true ;; esac case "$changed_path" in - requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION) deps=true ;; + requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; esac done <<<"$changed" else diff --git a/tests/test_changed_scope_dependency_manifest_allowlist.py b/tests/test_changed_scope_dependency_manifest_allowlist.py new file mode 100644 index 0000000000..d790971c41 --- /dev/null +++ b/tests/test_changed_scope_dependency_manifest_allowlist.py @@ -0,0 +1,62 @@ +"""Contract: the `changed-scope` dependency allowlist covers scannable manifests. + +`security-scan.yml` runs `osv-scan` and `dependency-review` only when the +`changed-scope` classifier sets `deps=true`, and that flag is restored from a +closed filename allowlist. A dependency introduced through a manifest or +lockfile missing from the list silently skips both supply-chain gates (Strix +MEDIUM finding on `.github#2143`, 2026-09-13). The list must therefore cover +every lockfile the pinned osv-scanner v2.5.1 can scan plus the manifests the +GitHub dependency graph reads. The three gate copies share one byte-identical +classifier block (see `test_docs_only_pr_runner_admission.py`), so this test +reads the line from each copy. +""" + +from __future__ import annotations + +from pathlib import Path + +WORKFLOWS_DIR = Path(__file__).resolve().parents[1] / ".github/workflows" +GATE_COPIES = ("security-scan.yml", "sast-semgrep.yml", "strix.yml") + +# osv-scanner v2.5.1 `docs/supported_languages_and_lockfiles.md` names, plus +# the manifests that declare dependencies before any lockfile exists. +REQUIRED_MANIFESTS = ( + "requirements*.txt", "pyproject.toml", "uv.lock", "pylock.*.toml", "poetry.lock", "pdm.lock", + "Pipfile", "Pipfile.lock", "setup.py", "setup.cfg", "environment.yml", + "package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb", "deno.lock", + "Cargo.toml", "Cargo.lock", "go.mod", "go.sum", "go.work", "go.work.sum", + "pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle", "gradle.lockfile", + "buildscript-gradle.lockfile", "libs.versions.toml", "verification-metadata.xml", + "Gemfile", "Gemfile.lock", "gems.locked", "composer.json", "composer.lock", "conan.lock", "conanfile.txt", + "packages.lock.json", "packages.config", "deps.json", "Directory.Packages.props", + "mix.exs", "mix.lock", "pubspec.yaml", "pubspec.lock", "Package.swift", "Package.resolved", + "Podfile", "Podfile.lock", "renv.lock", "DESCRIPTION", "stack.yaml.lock", "flake.lock", "vcpkg.json", +) +REQUIRED_SUFFIX_GLOBS = ("*.csproj", "*.fsproj", "*.vbproj", "*.gemspec", "*.nuspec") + + +def _deps_case_line(workflow_name: str) -> str: + """Return the single `case` pattern line that restores `deps=true`.""" + lines = [ + line.strip() + for line in (WORKFLOWS_DIR / workflow_name).read_text(encoding="utf-8").splitlines() + if line.rstrip().endswith(") deps=true ;;") + ] + assert len(lines) == 1, (workflow_name, len(lines)) + return lines[0] + + +def test_dependency_allowlist_names_every_scannable_manifest() -> None: + """Each gate copy lists every manifest at the root and under any directory.""" + for workflow_name in GATE_COPIES: + patterns = set(_deps_case_line(workflow_name).split(") deps=true")[0].split("|")) + for manifest in REQUIRED_MANIFESTS: + assert manifest in patterns, (workflow_name, manifest) + assert f"*/{manifest}" in patterns, (workflow_name, manifest) + for glob in REQUIRED_SUFFIX_GLOBS: + assert glob in patterns, (workflow_name, glob) + + +def test_dependency_allowlist_is_identical_across_gate_copies() -> None: + """The allowlist must not drift between the three classifier copies.""" + assert len({_deps_case_line(name) for name in GATE_COPIES}) == 1 From 54a76b1ebbfa96e4fe4c18e59fa633320bae3b82 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 13 Sep 2026 21:36:05 +0900 Subject: [PATCH 2/2] fix(changed-scope): add Deno, Bazel, Julia and Terraform manifests to the deps allowlist CodeRabbit on #2156: deno.json/deno.jsonc, MODULE.bazel(.lock)/WORKSPACE(.bazel)/ maven_install.json/*.MODULE.bazel, Manifest.toml/Project.toml, and .terraform.lock.hcl/*.tf/*.tofu also declare or lock dependencies that dependency-review and osv-scan should see. Same identical edit in the three classifier copies; contract test extended. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/sast-semgrep.yml | 2 +- .github/workflows/security-scan.yml | 2 +- .github/workflows/strix.yml | 2 +- tests/test_changed_scope_dependency_manifest_allowlist.py | 4 +++- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/sast-semgrep.yml b/.github/workflows/sast-semgrep.yml index ed14bc1420..457d4de48f 100644 --- a/.github/workflows/sast-semgrep.yml +++ b/.github/workflows/sast-semgrep.yml @@ -89,7 +89,7 @@ jobs: *) code=true ;; esac case "$changed_path" in - requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; + requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|deno.json|*/deno.json|deno.jsonc|*/deno.jsonc|MODULE.bazel|*/MODULE.bazel|MODULE.bazel.lock|*/MODULE.bazel.lock|WORKSPACE|*/WORKSPACE|WORKSPACE.bazel|*/WORKSPACE.bazel|maven_install.json|*/maven_install.json|Manifest.toml|*/Manifest.toml|Project.toml|*/Project.toml|.terraform.lock.hcl|*/.terraform.lock.hcl|*.MODULE.bazel|*.tf|*.tofu|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; esac done <<<"$changed" else diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index cf1be23bf5..90ad3a54e9 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -112,7 +112,7 @@ jobs: *) code=true ;; esac case "$changed_path" in - requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; + requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|deno.json|*/deno.json|deno.jsonc|*/deno.jsonc|MODULE.bazel|*/MODULE.bazel|MODULE.bazel.lock|*/MODULE.bazel.lock|WORKSPACE|*/WORKSPACE|WORKSPACE.bazel|*/WORKSPACE.bazel|maven_install.json|*/maven_install.json|Manifest.toml|*/Manifest.toml|Project.toml|*/Project.toml|.terraform.lock.hcl|*/.terraform.lock.hcl|*.MODULE.bazel|*.tf|*.tofu|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; esac done <<<"$changed" else diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index c01659ba19..125a880bf1 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -171,7 +171,7 @@ jobs: *) code=true ;; esac case "$changed_path" in - requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; + requirements*.txt|*/requirements*.txt|pyproject.toml|*/pyproject.toml|uv.lock|*/uv.lock|pylock.*.toml|*/pylock.*.toml|package.json|*/package.json|package-lock.json|*/package-lock.json|pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|go.mod|*/go.mod|go.sum|*/go.sum|pom.xml|*/pom.xml|build.gradle|*/build.gradle|build.gradle.kts|*/build.gradle.kts|DESCRIPTION|*/DESCRIPTION|poetry.lock|*/poetry.lock|pdm.lock|*/pdm.lock|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|setup.py|*/setup.py|setup.cfg|*/setup.cfg|environment.yml|*/environment.yml|environment.yaml|*/environment.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb|deno.lock|*/deno.lock|Gemfile|*/Gemfile|Gemfile.lock|*/Gemfile.lock|gems.rb|*/gems.rb|gems.locked|*/gems.locked|composer.json|*/composer.json|composer.lock|*/composer.lock|conanfile.txt|*/conanfile.txt|conanfile.py|*/conanfile.py|conan.lock|*/conan.lock|vcpkg.json|*/vcpkg.json|packages.config|*/packages.config|packages.lock.json|*/packages.lock.json|deps.json|*/deps.json|Directory.Packages.props|*/Directory.Packages.props|settings.gradle|*/settings.gradle|settings.gradle.kts|*/settings.gradle.kts|gradle.lockfile|*/gradle.lockfile|buildscript-gradle.lockfile|*/buildscript-gradle.lockfile|libs.versions.toml|*/libs.versions.toml|verification-metadata.xml|*/verification-metadata.xml|mix.exs|*/mix.exs|mix.lock|*/mix.lock|pubspec.yaml|*/pubspec.yaml|pubspec.lock|*/pubspec.lock|Package.swift|*/Package.swift|Package.resolved|*/Package.resolved|Podfile|*/Podfile|Podfile.lock|*/Podfile.lock|Cartfile.resolved|*/Cartfile.resolved|renv.lock|*/renv.lock|stack.yaml.lock|*/stack.yaml.lock|flake.lock|*/flake.lock|go.work|*/go.work|go.work.sum|*/go.work.sum|deno.json|*/deno.json|deno.jsonc|*/deno.jsonc|MODULE.bazel|*/MODULE.bazel|MODULE.bazel.lock|*/MODULE.bazel.lock|WORKSPACE|*/WORKSPACE|WORKSPACE.bazel|*/WORKSPACE.bazel|maven_install.json|*/maven_install.json|Manifest.toml|*/Manifest.toml|Project.toml|*/Project.toml|.terraform.lock.hcl|*/.terraform.lock.hcl|*.MODULE.bazel|*.tf|*.tofu|*.csproj|*.fsproj|*.vbproj|*.gemspec|*.nuspec) deps=true ;; esac done <<<"$changed" else diff --git a/tests/test_changed_scope_dependency_manifest_allowlist.py b/tests/test_changed_scope_dependency_manifest_allowlist.py index d790971c41..c7964aa57f 100644 --- a/tests/test_changed_scope_dependency_manifest_allowlist.py +++ b/tests/test_changed_scope_dependency_manifest_allowlist.py @@ -31,8 +31,10 @@ "packages.lock.json", "packages.config", "deps.json", "Directory.Packages.props", "mix.exs", "mix.lock", "pubspec.yaml", "pubspec.lock", "Package.swift", "Package.resolved", "Podfile", "Podfile.lock", "renv.lock", "DESCRIPTION", "stack.yaml.lock", "flake.lock", "vcpkg.json", + "deno.json", "deno.jsonc", "MODULE.bazel", "MODULE.bazel.lock", "WORKSPACE", "WORKSPACE.bazel", + "maven_install.json", "Manifest.toml", "Project.toml", ".terraform.lock.hcl", ) -REQUIRED_SUFFIX_GLOBS = ("*.csproj", "*.fsproj", "*.vbproj", "*.gemspec", "*.nuspec") +REQUIRED_SUFFIX_GLOBS = ("*.csproj", "*.fsproj", "*.vbproj", "*.gemspec", "*.nuspec", "*.MODULE.bazel", "*.tf", "*.tofu") def _deps_case_line(workflow_name: str) -> str: