fix(security): fail closed on unavailable dependency review - #897
fix(security): fail closed on unavailable dependency review#897seonghobae wants to merge 11 commits into
Conversation
|
Warning Review limit reached
Next review available in: 55 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughdependency-review 게이트가 exact base/head 비교의 HTTP 200 증거만 허용하도록 변경되었습니다. 오류, 빈 응답, 부분 전송, 비정상 상태 코드는 실패 처리합니다. PR head checkout, 회귀 계약 테스트, 운영 문서를 갱신했습니다. Changes공급망 검증 제어
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The dependency-review gate is changed to fail closed when comparison evidence is unavailable, and no actionable merge-blocking risk remains in the supplied evidence beyond normal checks and review. Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant security_scan
participant GitHubCompareAPI
participant dependency_review
PullRequest->>security_scan: PR head repository와 head SHA 전달
security_scan->>GitHubCompareAPI: 정확한 base...head 비교 요청
GitHubCompareAPI-->>security_scan: HTTP 상태와 전송 결과 반환
security_scan->>dependency_review: 전송 코드 0 및 HTTP 200일 때 실행
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/oc Refetch and abort unless exact head is still Fix test-first on this existing branch only. Add a permanent regression that models a fake/controlled curl which writes HTTP Strengthen |
|
Exact-head RCA and proof for
Hosted exact-head security and supply-chain results remain authoritative. |
|
@opencode-agent review Evaluate exact current head |
|
Follow-up at current head |
|
@opencode-agent review Review exact current head |
|
@coderabbitai review Review exact current head |
|
I will verify the dependency-review fail-closed boundary and the listed workflow invariants. I will keep exact-head check evidence separate from review judgment, approval, and merge authority. I will not modify code, merge, or change protections. I used the repository guidance that only successful checks for the exact current head are valid merge evidence. 🧠 Learnings used
|
|
Exact-current-head review request for Review the bounded six-file supply-chain evidence repair: dependency-review support accepts only HTTP 200; non-200, timeout, or unavailable comparison fails closed with exact identity and operator guidance; response bodies are discarded; checkout is bound to the explicit PR head repository/SHA; and read-only permissions plus immutable action pins remain. Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation are terminal-success on this exact head. No review thread exists. Keep the exact head unchanged. Do not update the branch, synthesize author approval, substitute another scanner for dependency-review evidence, add credentials, merge, release, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@opencode-agent review Re-evaluate exact current head |
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review Please provide an independent exact-head review of |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
Pull request was converted to draft
|
Returned to Draft because this branch overlaps the authoritative prerequisite #821 and no longer matches its own four-file bounded-scope claim. #821 already owns the fail-closed dependency-review boundary and exact-head focused quality gate. This branch contains a useful incremental refinement—capturing the After #821 reaches protected |
|
@coderabbitai review Please review exact head |
Rate Limit Exceeded
|
|
Please perform a fresh exact-head semantic review of |
|
@cwl-noema-review After a qualifying exact-head OpenCode verdict, independently review |
|
@opencode-agent review exact head |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Exact-head permission-contract repair for #1222 / #810:
Every head-oriented Security checkout remains bound and runtime-attested to the submitted PR head, and OSV remains explicitly dual-revision. Hosted exact-head checks and a substantive exact-head formal verdict must regenerate; predecessor evidence is non-passing. @opencode-agent review this exact head only. Review-only; do not mutate or merge the branch. |
|
Exact-head review handoff for The two current informational threads are now dispositioned against the live required-workflow contract and resolved:
All 12 substantive exact-head hosted workflows are successful, with only the unrelated repair workflow skipped; unresolved threads are zero. No exact-current-head formal Reviews API verdict exists yet. @opencode-agent review Review-only request: inspect the exact-head binding and fail-closed dependency-evidence boundary and submit a substantive formal verdict for this SHA. |
|
Protected-main synchronization moved the exact head to @opencode-agent review |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
d9b395cd01999a6ec946d3c7a013f22225143782. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97179798282)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97179798282)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
d9b395cd01999a6ec946d3c7a013f22225143782. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97191695465)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32633538138/job/97191695465)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
|
Fresh downstream consumer reproduction for #810; not closure and not leaf-owned remediation.
RCA remains the central fail-open capability path described by #810; OSV/Trivy/Scorecard success is not a semantic substitute for the skipped dependency-review hard gate. This exact Inkspan head must therefore remain non-passing for supply-chain acceptance even though GitHub displays Security Scan green. Current owner-path acceptance for this consumer: after this repair reaches protected central |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
ee18e75f2ad4be357ec8047e6fac851895b6487e. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32674599487/job/97280550660)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32674599487/job/97280550660)
- strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32674615971)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
|
Exact-current-head formal review requested for |
|
@cwl-noema-review Please provide an independent formal exact-head review of current owner head Fresh state before this request: the 13 substantive commit-associated workflows for Please verify the actual current diff rather than predecessor prose, especially: exact PR-head repository/SHA checkout; curl transport exit and HTTP 200 both required before the pinned Dependency Review action; no 403/404/empty/partial-transfer path can green the hard gate; visibility/status evidence does not become root-cause inference; and any action-skip path remains fail-closed. Submit the result through the Reviews API/formal review surface, not status-only acknowledgement. This request is review advancement only; it does not authorize merge or close #810, which still requires protected-main downstream consumer proof. |
Merge protected main 0c6b9a6 while retaining only Security Scan owner changes. Full suite: 1,399 passed, 1 skipped, 16 subtests; shared full Strix quick-gate: PASS.
|
@opencode-agent review Please submit a substantive formal Reviews API verdict for exact current head |
|
@opencode-agent review Please publish an independent substantive formal Reviews API verdict for exact current head |
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
6406b4663b216e4a85fbf96a7cbd33bf9c0a990e. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32710533347/job/97380758535)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32710533347/job/97380758535)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
6406b4663b216e4a85fbf96a7cbd33bf9c0a990e. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/32710533347/job/97549503711)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/32710533347/job/97549503711)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: dependency-review-fail-closed.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: dependency-review-fail-closed.md"]
R3 --> V3["docs review"]
Evidence --> S4["Test: test_required_workflow_queue_contract.py"]
S4 --> I4["regression suite"]
I4 --> R4["Review risk: Test: test_required_workflow_queue_contract.py"]
R4 --> V4["targeted test run"]
1 participant
Purpose
Replace the stale, conflicted #799 integration path with a bounded current-main repair for #810. Preserve #799 as historical evidence only; do not import its divergent removal of later Strix work.
Root cause
The central required
Security Scancould conclude success when the exact dependency-review comparison returned HTTP 403 or 404. The support probe emittedsupported=false, exited zero, and skipped the pinned Dependency Review action. A hard supply-chain evidence boundary had therefore been modeled as an optional capability optimization.Remedy and TDD identity
6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;b06bb25c1af99b784730209dceb299cd493734f7reverses the stale fail-open queue contract;71947d24828cfb42806f5ef0a8abf83f9279d0afaccepts only HTTP 200, preserves curl transport status separately, bounds connect/total time, discards the response body, checks out the explicit PR-head repository/SHA, and emits exact-identity failure evidence;b527192d7b758fc2f8a95545f25545cec7747c99proves a partial transfer that prints200but exits non-zero cannot pass;59d702f30fa419a016e24c18e87e05c76fbee4a3;Scope correction
Unrelated scheduler-secret and Python-lock-materializer source/test changes that had accumulated on this branch were removed. Flattening an include-bearing requirements lock under a generated filename does not preserve relative include targets and requires a separately designed, test-first path-preservation contract.
The final scope changes only the Dependency Review control plane and its durable architecture, operator, release-note, and workflow-contract evidence. The existing executable mode of
scripts/ci/materialize_base_python_requirements.pyis preserved; the final mode-only correction introduces no source-content change.Acceptance contract
Merge only after:
After merge, require a protected-main public-repository consumer run proving a non-200 or failed-transfer comparison cannot produce a green Dependency Review gate before closing #810.
Summary by CodeRabbit
보안 강화
문서
테스트