ci(workflows): consume protected central dependency review after fail-closed owner repair #654
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,6 +8,7 @@ | |
| OSV_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "osvscanner.yml" | ||
| K8S_DEPLOYMENT = REPO_ROOT / "infra" / "k8s" / "deployment.yaml" | ||
| K8S_SERVICE = REPO_ROOT / "infra" / "k8s" / "service.yaml" | ||
| CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA = "5f8e5b2a79e709c4ab1a4179a605d34c458b13a1" | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
caller_sha="$(
sed -n 's/.*dependency-review\.yml@\([0-9a-f]\{40\}\).*/\1/p' \
.github/workflows/dependency-review.yml
)"
test_sha="$(
sed -n 's/^CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA = "\([0-9a-f]\{40\}\)".*/\1/p' \
tests/config/test_strix_static_repo_adaptations.py
)"
test "$caller_sha" = "$test_sha"
merged="$(gh api repos/ContextualWisdomLab/.github/pulls/1725 --jq .merged)"
draft="$(gh api repos/ContextualWisdomLab/.github/pulls/1725 --jq .draft)"
owner_sha="$(gh api repos/ContextualWisdomLab/.github/pulls/1725 --jq .merge_commit_sha)"
test "$merged" = "true"
test "$draft" = "false"
test "$caller_sha" = "$owner_sha"Repository: ContextualWisdomLab/scopeweave Length of output: 168 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository review guidance ---'
find /tmp/coderabbit-repo-knowledge/contextualwisdomlab-scopeweave-647613e1/contextualwisdomlab-scopeweave-647613e1 \
-type f -name '*.md' -maxdepth 3 -print 2>/dev/null | sort | head -50
printf '%s\n' '--- changed test constant ---'
cat -n tests/config/test_strix_static_repo_adaptations.py | sed -n '1,45p'
printf '%s\n' '--- workflow caller ---'
cat -n .github/workflows/dependency-review.yml | sed -n '1,40p'
printf '%s\n' '--- local references to the pin and owner PR ---'
rg -n -F '5f8e5b2a79e709c4ab1a4179a605d34c458b13a1' .github tests
rg -n -F '1725' .github tests || trueRepository: ContextualWisdomLab/scopeweave Length of output: 203 🌐 Web query:
💡 Result: The provided reference to ContextualWisdomLab pull request 1725, the dependency-review.yml file, and the specific merge_commit_sha 5f8e5b2a79e709c4ab1a4179a605d34c458b13a1 does not correspond to a documented event within the ContextualWisdomLab organization as of September 3, 2026 [1][2]. The ContextualWisdomLab organization maintains a central.github repository that manages shared workflows and governance [2]. While the organization uses various CI/CD security practices, including automated pull request reviews and dependency scanning [3][4], research into their public repository activities shows their recent pull request numbering is significantly lower than 1725 (e.g., recent merges were in the 500s range) [5][6][7]. The SHA provided (5f8e5b2a79e709c4ab1a4179a605d34c458b13a1) is not associated with any recorded commit in the organization's public repositories [2]. Furthermore, dependency-review.yml is a standard GitHub Actions workflow file used for security scanning [8][9], and while it is commonly configured in such repositories, the specific link between that filename, that PR number, and that commit hash appears to be invalid or does not exist in the public record [2]. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository review guidance ---'
find /tmp/coderabbit-repo-knowledge/contextualwisdomlab-scopeweave-647613e1 \
-type f -name '*.md' -maxdepth 3 -print 2>/dev/null | sort | head -50
printf '%s\n' '--- changed test constant ---'
cat -n tests/config/test_strix_static_repo_adaptations.py | sed -n '1,45p'
printf '%s\n' '--- workflow caller ---'
cat -n .github/workflows/dependency-review.yml | sed -n '1,40p'
printf '%s\n' '--- local references to the pin and owner PR ---'
rg -n -F '5f8e5b2a79e709c4ab1a4179a605d34c458b13a1' .github tests
rg -n -F '1725' .github tests || trueRepository: ContextualWisdomLab/scopeweave Length of output: 4975 🏁 Script executed: #!/usr/bin/env bash
set -u
printf '%s\n' '--- workflow conventions ---'
cat /tmp/coderabbit-repo-knowledge/contextualwisdomlab-scopeweave-647613e1/conventions/github-workflows.md
printf '%s\n' '--- test conventions ---'
cat /tmp/coderabbit-repo-knowledge/contextualwisdomlab-scopeweave-647613e1/conventions/tests.md
printf '%s\n' '--- owner PR metadata ---'
curl -sS -L -D /tmp/owner-pr.headers \
-H 'Accept: application/vnd.github+json' \
'https://api.github.com/repos/ContextualWisdomLab/.github/pulls/1725' \
-o /tmp/owner-pr.json
sed -n '1,12p' /tmp/owner-pr.headers
python3 - <<'PY'
import json
from pathlib import Path
p = Path('/tmp/owner-pr.json')
try:
data = json.loads(p.read_text())
except Exception as exc:
print(f'json_error={exc}')
else:
for key in ('message', 'number', 'state', 'draft', 'merged', 'merge_commit_sha', 'base', 'head'):
if key in data:
value = data[key]
if key in ('base', 'head') and isinstance(value, dict):
value = {k: value.get(k) for k in ('ref', 'sha', 'repo')}
print(f'{key}={value}')
PY
printf '%s\n' '--- pinned commit metadata ---'
curl -sS -L -D /tmp/pinned-commit.headers \
-H 'Accept: application/vnd.github+json' \
'https://api.github.com/repos/ContextualWisdomLab/.github/commits/5f8e5b2a79e709c4ab1a4179a605d34c458b13a1' \
-o /tmp/pinned-commit.json
sed -n '1,12p' /tmp/pinned-commit.headers
python3 - <<'PY'
import json
from pathlib import Path
data = json.loads(Path('/tmp/pinned-commit.json').read_text())
for key in ('message', 'sha', 'html_url'):
if key in data:
print(f'{key}={data[key]}')
PYRepository: ContextualWisdomLab/scopeweave Length of output: 14881 🌐 Web query:
💡 Result: The GitHub URL provided, https://api.github.com/repos/ContextualWisualLab/.github/pulls/1725, refers to a specific pull request within the.github repository of the Contextual Wisdom Lab (맥락지혜 연구실) organization [1][2]. Contextual Wisdom Lab is a research group founded by Seongho Bae that focuses on developing AI decision-support systems for enterprise contexts [1][3]. Their.github repository functions as a central hub for organization-wide governance, CI/CD workflows, and administrative assets [2]. While the search confirmed the existence and structure of the ContextualWisdomLab organization and its.github repository, pull request Citations:
🏁 Script executed: #!/usr/bin/env bash
set -u
printf '%s\n' '--- central workflow at the pinned commit ---'
curl -sS -L \
'https://raw.githubusercontent.com/ContextualWisdomLab/.github/5f8e5b2a79e709c4ab1a4179a605d34c458b13a1/.github/workflows/dependency-review.yml' |
nl -ba | sed -n '1,220p'
printf '%s\n' '--- central workflow at the open PR head ---'
curl -sS -L \
'https://raw.githubusercontent.com/ContextualWisdomLab/.github/58a0b4c8ecc3073a64bd91457101229a21f020d4/.github/workflows/dependency-review.yml' |
nl -ba | sed -n '1,240p'
printf '%s\n' '--- PR commit list ---'
curl -sS -L \
-H 'Accept: application/vnd.github+json' \
'https://api.github.com/repos/ContextualWisdomLab/.github/pulls/1725/commits?per_page=100' |
python3 -c '
import json, sys
data=json.load(sys.stdin)
if isinstance(data, list):
for c in data:
print(c.get("sha"), c.get("commit", {}).get("message", "").splitlines()[0])
else:
print(data)
'Repository: ContextualWisdomLab/scopeweave Length of output: 1932 🏁 Script executed: #!/usr/bin/env bash
set -u
for ref in \
5f8e5b2a79e709c4ab1a4179a605d34c458b13a1 \
58a0b4c8ecc3073a64bd91457101229a21f020d4
do
file="/tmp/dependency-review-${ref}.yml"
curl -sS -L \
"https://raw.githubusercontent.com/ContextualWisdomLab/.github/${ref}/.github/workflows/dependency-review.yml" \
-o "$file"
printf '%s\n' "--- ${ref}: relevant workflow lines ---"
grep -n -E 'permissions:|contents:|pull-requests:|dependency.graph|dependency-review-action|failure|non-200|identity|repository|ref|sha|exit' "$file" || true
done
printf '%s\n' '--- exact commit metadata ---'
for sha in \
5f8e5b2a79e709c4ab1a4179a605d34c458b13a1 \
58a0b4c8ecc3073a64bd91457101229a21f020d4 \
06728a05e014550df52fc269e855975a9dc9d1f9
do
printf '%s\n' "--- ${sha} ---"
curl -sS -L \
-H 'Accept: application/vnd.github+json' \
"https://api.github.com/repos/ContextualWisdomLab/.github/commits/${sha}" |
python3 -c '
import json, sys
d=json.load(sys.stdin)
print("sha=", d.get("sha"))
print("message=", d.get("commit", {}).get("message", "").splitlines()[0])
print("parents=", [p.get("sha") for p in d.get("parents", [])])
'
doneRepository: ContextualWisdomLab/scopeweave Length of output: 6738 Security Misconfiguration (CWE-693) Reachability: External 보호된 중앙 workflow 커밋으로 두 핀을 갱신한 뒤 병합하십시오. 현재 SHA는 dependency-graph 비교의 HTTP 403/404 응답을 📍 Affects 2 files
🤖 Prompt for AI Agents
Contributor
Author
There was a problem hiding this comment. Confirmed accurate, still genuinely open — not resolved yet, correctly. Both files here already point to the latest available central SHA ( 🤖 Addressed by Claude Code There was a problem hiding this comment.
The fail-closed repair depends on 🐇🔍 ✏️ Learnings added
You are interacting with an AI system. |
||
|
|
||
|
|
||
| def test_central_review_workflows_are_not_copied_into_this_repository() -> None: | ||
|
|
@@ -56,11 +57,18 @@ def test_kubernetes_deployment_uses_non_root_versioned_runtime() -> None: | |
| assert 'targetPort: 8080' in service_source | ||
|
|
||
|
|
||
| def test_companion_workflows_pin_central_dependency_review_and_cover_osv_manifests() -> None: | ||
| dependency_review_source = DEPENDENCY_REVIEW_WORKFLOW.read_text(encoding="utf-8") | ||
| osv_source = OSV_WORKFLOW.read_text(encoding="utf-8") | ||
|
|
||
| expected_reusable_workflow = ( | ||
| "ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@" | ||
| f"{CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA}" | ||
| ) | ||
| assert expected_reusable_workflow in dependency_review_source | ||
| assert "dependency-review.yml@main" not in dependency_review_source | ||
| assert "permissions:\n contents: read\n pull-requests: read" in dependency_review_source | ||
| assert "fail_on_severity: moderate" in dependency_review_source | ||
| assert 'requirements(-[A-Za-z0-9._-]+)?\\.txt' in osv_source | ||
| assert "google/osv-scanner-action" in osv_source | ||
| assert "-r" in osv_source | ||
Uh oh!
There was an error while loading. Please reload this page.