Repository navigation
Keep the vulnerable grype positive-control fixture out of Scorecard's dependency scan - #224
Merged
seathatflowsinourveins merged 3 commits intoSep 25, 2026
Conversation
blueprints/gap-wave2-20260923/grype-known-cve-fixture/requirements.txt (urllib3==1.26.4, CVE-2021-33503) fed GitHub's dependency graph and kept code-scanning alert #19 open, even though this repo's own osv-scanner and Dependabot configs already excluded it -- Scorecard's "Vulnerabilities" check does not honor either exclusion list. Renaming it to requirements.txt.fixture makes it invisible to every manifest scanner (Dependabot, OSV-Scanner, the dependency graph) while keeping the positive control intact: tests/test_grype_known_cve_fixture.py now copies it into a fresh temp directory as requirements.txt immediately before invoking grype, and never writes that copy into the repository tree. Both scanner exclusions (the pip entry in .github/dependabot.yml, the excluded entry in .github/osv-scanner-lockfiles.json) are now unneeded -- the file is no longer a recognized manifest name at all -- so both are removed rather than kept with a stale reason. docs/github-automation.md and the closure decision doc are updated to match; manifests/evidence.json is updated surgically (renamed path, refreshed hashes for the changed files). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Independent review confirmed the code change is correct (syft finds urllib3 1.26.4 in the temp-copied requirements.txt, 0 packages in the renamed in-repo fixture); this round only corrects doc/test-docstring statements found imprecise or wrong: - docs/github-automation.md: the osv-scanner `excluded` list is not empty; it still names three gap-wave-2 DVC-lock evidence fixtures. Describe it accurately instead. - docs/decisions/2026-09-22-github-automation-closure.md: replace the wrong "reads the dependency graph directly" reasoning with the actual mechanism (Scorecard v5.5.0's vulnerabilities check runs OSV-Scanner/osv-scalibr directly over repository files, matching any *requirements*.txt name, which is why this repo's own exclusion lists were never honored). Say alert #19 is "expected to close" (not "closing"), credit the rename rather than the Dependabot removal, add the verification command, and add alternatives-considered and an overturn condition to both superseded notes. - tests/test_grype_known_cve_fixture.py: fix the docstring's backwards claim ("grype scans by directory content, not filename convention" -> syft's Python cataloger matches by filename convention, any *requirements*.txt, which is exactly why the temp copy is needed); split the fixture-content checks (declares urllib3==1.26.4, matches its registered sha256) into an unconditional test class so CI checks the fixture even where grype is absent (including the validate job); assert the temp scan directory resolves outside the repository root before copying into it. - catalogs/foundation/automation.json: update the stale osv-scanner job description to match the corrected exclusion-list and fixture-naming state. - manifests/evidence.json: refreshed hashes for the four changed files. Six validators and the targeted test modules re-run clean. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
deleted the
claude/scorecard-fixture-rename-20260925
branch
September 25, 2026 02:03
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Sep 25, 2026
evidence.json was rebuilt from main's copy with this branch's six changed entries refreshed. #224 renamed the fixture this branch still registered under its old path. The docs auto-merged; both changes are present. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Sep 25, 2026
…y branch evidence.json was rebuilt from main's copy. This branch's convergence-record entry and its ten sim-capacity file registrations were re-applied. The CI lock path this branch still carried was not re-registered, because #233 renamed it. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Sep 25, 2026
…porate-action and credential guards Main moved 19 commits since 5ed8538. The conflicts were resolved by keeping both sides: - native_strategy.py: AdaptiveStrategy takes both halted= (E4) and corporate_action_guard= (#222). The constructor keeps the halt and callback-fault state and the corporate-action guard state. cancel_expired keeps the halted-exit skip (E4) and gains #222's symbols= immediate-cancel set. - runner.py: the strategy gets both halted=controller.is_halted and the corporate-action guard. The shutdown runs stop_halt_seed() inside #222's try/finally, so the corporate-action refresh cleanup still runs if the halt-seed stop raises. - source-hashes.json: the union of both sides' keys, every digest recomputed from the merged tree. - manifests/evidence.json: main's registry, plus the branch's new engine-nautilus probe, with all stale digests refreshed. The branch's entries for the renamed CI lock (#233) and the renamed grype fixture (#224) are dropped. Checks on the merged tree: - pinned rc5 runtime, 23 paper modules: 1,320 tests OK (2 skipped); - full python3 -m unittest: 4,944 tests OK (600 skipped); - validate.py, evidence_manifest.py --check, and the source-hashes manifest test: pass. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 3, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 3, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 3, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 3, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 3, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 4, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
pushed a commit
that referenced
this pull request
Oct 4, 2026
…ecision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
seathatflowsinourveins
added a commit
that referenced
this pull request
Oct 4, 2026
…ant) (#635) * Record and guard the Dependabot alert 16 dismissal on the frozen macOS variant The closure record notes the dismissal of Dependabot alert 16 (GHSA-vcvr-r3jv-pc5j) as not_used on the frozen macOS variant's package.json, with its API readback receipt, evidence/receipts/dependabot-alert-16-dismissal-20261003.json. tests/test_frozen_macos_variant_no_use.py, a tripwire in the required validate job, fails when: - a scanned file names the frozen artifact directory beyond its pinned lines; - the directory gains a file; - the lock or its next pin changes; - the frozen OSV exception's date or keys change. The guard's mutation driver is kept under evidence/artifacts/frozen-variant-guard-mutations-20261003/. The anti-pattern log gains two 2026-10-03 rows. This commit replaces the branch's earlier content commits (review rounds 1-7), rebuilt on main 4ced292, so that no commit on the branch quotes a user message. Its tree equals round 7's first content commit 8f547913, apart from main's changes since 9b0b8d6. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Retain the guard's mutation runs and disclose the retained driver's assembled name The mutation driver's returned results are kept under evidence/artifacts/frozen-variant-guard-mutations-20261003/: - round 8's final run: all 45 rows against the content commit a447a51, every row as expected; - round 7's three runs of the new rows against the round-3, round-4 and round-5 modules. Each gap row passes there, so each of these runs exits 1 by design. runs.json gives the argument vectors, times, exit codes, clone heads and hashes. Clone roots, the output directory and the Python prefix are replaced with placeholders. The receipt's table equals the retained output (45 rows, 0 mismatches) and binds the driver and runs.json by sha256. Its limitations now say: - the retained driver assembles the artifact name from fragments, a stated blind spot of the guard, and installs, builds or serves nothing; - configuration names inside an excluded class that differ only in letter case are not read. The closure note says "ASCII letter case", since the module folds ASCII letters only. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Keep the control runs' modules, rebuild the controls on main and record the indirect-route decision This commit answers the Codex review at 06c90df. Control runs: - The three earlier modules the control runs used are kept byte for byte, as .txt files, under evidence/artifacts/frozen-variant-guard-mutations-20261003/controls/. The guard does not read .txt files under evidence/**, and the receipt says so. - The control runs were re-run on main's d2777ee with each kept module committed in a scratch clone, so anyone can rebuild them from the repository. Their outcomes, failing tests and messages equal round 7's runs, which they replace. runs.json records each control's base commit and module file. Indirect routes: the receipt gains indirect_routes, a dated decision. The dismissal stands, and the indirect routes stay stated limits. The record names: - the alternatives declined: pinning the 43 lines that read the inventory, pinning the 297 package-manager lines, resolving each command's target, reopening the alert, and keeping the frozen manifest under names that tools don't parse; - the precedent; - the dated backstop of the OSV exception: it lapses on 2026-12-24, can be renewed at most 90 days ahead, and each renewal fails the review-date test. The closure note points to the decision. Round 8 review fixes: - runs.json defines <repo> without tying it to the final run's clone head. - runs.json describes the commits after the content commit accurately. - The receipt states X15's correction as a deduction from the module. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Correct the alert-16 backstop and precedent, record the convergence decision and log the tripwire scope miss This commit answers the round-9 review and the Codex review at 9faa5c4. Backstop: once the frozen exception lapses, the required osv-scanner job fails in its unittest preflight (FrozenScanTests) before OSV-Scanner runs, and validate's full suite fails IgnorePolicyTests, both through ignore_entry_problems. A renewal that also edits REVIEW_DATE passes, and the receipt now says so. Precedent: the dismissal of alerts 7-15 that this record cites was superseded on 2026-09-25 by renaming the fixture (#224). The authorization, reasoning.precedent and indirect_routes now say so. Convergence decision: indirect_routes records the same day's convergence round. It ran Claude and GPT-6 research, two GPT-6 Astra and two Claude Opus votes, and took the GitHub/CI lane session's input. It chose to rename both frozen variant files to .frozen and stop scanning them in a follow-up pull request. The dismissal and the tripwire stand until then. The overturn and the closure note carry the new conditions. Other fixes: - The two counts now record their exact git grep commands. - The statement that the guard does not read the .txt control modules names the recogniser's conditions. - docs/harness-defaults.md gains a row for scoping a tripwire by expected file kinds, proven by controls N1, N4-N6, N7 and X13. - The branch is rebased onto main 59f8a1e (#653). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Qualify the tripwire-scope anti-pattern row to the guard's actual reach The Codex review at 47da9f8 found that the new row's rule said the guard reads JSON launch configurations inside the record classes. The guard deliberately leaves `evidence/**/launch.json` unread: it is stated limit L5, and its control passes. The rule now scans every file outside the record classes, reads each recognised runnable or configuring kind inside them, and names every kind left unread as a stated limit with a passing control. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Register the alert-16 receipt, the changed records and the retained mutation runs in manifests/evidence.json Hot-file protocol (docs/lanes.md): this is the branch's last commit, on main e0c329a (#677), and takes main's manifests/evidence.json. It re-registers the closure record, the receipt and docs/harness-defaults.md, and the 71 files under evidence/artifacts/frozen-variant-guard-mutations-20261003/. component_matrix --write and new_host_grand_list --write changed nothing else. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Scout <scout@local> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
OpenSSF Scorecard (report-only) keeps code-scanning alert #19 open: "9 existing vulnerabilities". All nine advisories are urllib3: PYSEC-2021-108, PYSEC-2023-192, PYSEC-2023-212, PYSEC-2026-141, and PYSEC-2026-1994, -1995, -1996, -1998 and -1999. Every one of them comes from the deliberately vulnerable positive-control fixture
blueprints/gap-wave2-20260923/grype-known-cve-fixture/requirements.txt(urllib3==1.26.4), which exists to prove grype detects a known CVE. Our own osv-scanner and Dependabot configurations already exclude that file, but Scorecard does not honour those exclusions.This PR stops manifest scanners from seeing the fixture while keeping the control:
requirements.txtbecomesrequirements.txt.fixture(git mv, byte-identical, sha256d3b3b594…). This is the same pattern the repo's other positive control already uses.tests/test_grype_known_cve_fixture.pycopies the fixture into a fresh temporary directory asrequirements.txtjust before running grype. The copy is never written into the tree..github/osv-scanner-lockfiles.jsonexclusion would otherwise failtests/test_osv_lockfile_coverage.py, which requires an excluded path to be a tracked file.pipblock for that directory no longer has any manifest to discover.docs/github-automation.mdis updated. The dated decision record keeps its original text and gains "Superseded (2026-09-25)" notes; dated evidence artifacts are untouched.Checks
Tests:
tests.test_grype_known_cve_fixturetest_osv_lockfile_coverage,test_workflow_hardening,test_workflow_security(_coverage),test_research_workflow,test_adoption_bootstrap,test_adoption_docs_consistency,test_foundation_catalog,test_gitleaks_configValidators: all six pass.
zizmor offline: clean.
gitleaks: history scan (
--log-opts=HEAD) and dir scan are both clean.Not covered
main.🤖 Generated with Claude Code