ci(security): guard .trivyignore against undocumented and phantom suppressions - #329
Conversation
…pressions The central trivy-fs gate (Security Scan required workflow in ContextualWisdomLab/.github) blocks PRs on fixable CRITICAL/HIGH/MEDIUM findings across the whole PR head. On PR #315 the old SARIF-only gate failed without printing findings, and automation responded by adding CVE-2021-4238 (Go goutils) and CVE-2022-26945 (Go go-getter) to .trivyignore. Those are Go-module vulnerabilities: this repository ships no go.mod/go.sum, no .go sources, and no Go binaries (the trivy run saw exactly one language file, uv.lock), so the entries could never match a real finding here. The actual blocker was DS-0002 firing on a stale PR base that predated the Dockerfile.test USER and documented .clusterfuzzlite ignore fixes already on develop. Make that failure mode structurally hard to repeat: - .trivyignore: document the suppression contract inline — which central gate consumes the file (trivy fs ., CRITICAL/HIGH/MEDIUM, ignore-unfixed, default --ignorefile pickup so no workflow wiring is needed), and that every entry needs the id, affected artifact, reason it is unfixable here, and a revisit condition. - tests/test_fuzzing_integration.py: enforce the contract — every entry must carry an adjacent comment block naming it with a revisit condition, and the two phantom Go CVEs stay out while the repo has no tracked Go artifacts. - AGENTS.md: record the gate mechanics and the anti-pattern (read the printed findings table or trivy-fs SARIF, rebase stale branches first, bump dependencies before suppressing). Verified: uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100 (347 passed, 100% coverage, PYTHONWARNINGS=error), uv run mkdocs build --strict, and pip-audit over the exported uv.lock pins (no known vulnerabilities), in line with the latest trivy-fs run on a develop-based head reporting 0 CRITICAL/HIGH/MEDIUM findings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Fxd76REwJfmQcXCJjLi6Z
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryApproval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_fuzzing_integration.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_fuzzing_integration.py"]
R2 --> V2["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including AGENTS.md, tests/test_fuzzing_integration.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects AGENTS.md to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: PR strengthens .trivyignore governance with documentation and tests
- Head SHA:
d403653f93b172e9909501641ac422596b933881 - Workflow run: 29146056482
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Test: test_fuzzing_integration.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_fuzzing_integration.py"]
R2 --> V2["targeted test run"]
2 participants
Summary
.trivyignoreCVE additions from PR 🛡️ Sentinel: [HIGH] 임시 파일 정리 누락으로 인한 DoS 취약점 수정 #315, then hardened the repo against a repeat.github.com/Masterminds/goutils,github.com/hashicorp/go-getter), and this repository has nogo.mod/go.sum, no.gosources, and no Go binaries ondevelopor on the PR 🛡️ Sentinel: [HIGH] 임시 파일 정리 누락으로 인한 DoS 취약점 수정 #315 head. The failing trivy-fs job log (run 29055066681, job 86244555409) shows the scan saw exactly one language-specific file (uv.lock) plus 4 Dockerfiles — so there was nothing to bump and nothing those ignore entries could ever match. The real blocker on that PR head was DS-0002 firing on a stale base (4a68893) that predated develop'sDockerfile.testUSER ciuserfix and the documented.clusterfuzzliteignore. The old central gate ran withseverity: CRITICAL,HIGH,exit-code: 1and SARIF-only output, so the failure printed nothing readable and automation guessed at the cause.trivy-fscheck is the central required "Security Scan" workflow inContextualWisdomLab/.github, which already runstrivy fs .from the repo root. Trivy honours the plain root.trivyignoreautomatically (it is the default--ignorefile), so notrivyignores:/TRIVY_IGNOREFILEwiring is needed or added; a repo-local copy of the central workflow would violate org governance. Instead,.trivyignorenow documents inline which gate consumes it and the mandatory entry format (id, affected artifact, why unfixable here, revisit condition), with the existing DS-0002 entry as the template.CRITICAL,HIGH,MEDIUM+ignore-unfixedwith a SARIF-parsing findings-table step (Print Trivy findings that failed the gate), and the latest run on a develop-based head (run 29140146044) reports 0 CRITICAL/HIGH/MEDIUM findings — develop passes the MEDIUM+ gate today. Independently re-verified locally:pip-auditover all exporteduv.lockpins finds no known vulnerabilities, so no dependency bumps were needed.exit 1;AGENTS.mdnow tells contributors/automation to read that table (or thetrivy-fsSARIF in code scanning) and to rebase stale branches ontodevelopbefore treating a repo-wide finding as real..trivyignorecontract: every entry must carry an adjacent comment naming it with a revisit condition, and the two phantom Go CVEs stay out while the repo tracks no Go artifacts (mutation-tested: appending an undocumentedCVE-2021-4238fails both guards).Git Flow target
develop(normal work branch).Verification
pytest—uv run pytest: 347 passedPYTHONWARNINGS=error pytest—PYTHONWARNINGS=error PYTHONPATH=src uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100: 347 passed, 100.00% coverageuv run mkdocs build --strictpip-auditoveruv export --locked --all-extraspins: no known vulnerabilitiesCVE-2021-4238entry to.trivyignoremakes both new tests fail; reverting restores greenNotes
develop(which drops its.trivyignorehunk) rather than more suppressions.🤖 Generated with Claude Code
https://claude.ai/code/session_018Fxd76REwJfmQcXCJjLi6Z
Generated by Claude Code