From f79476a6b8371d1828879525951deff7e4a9739d Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Thu, 6 Aug 2026 18:58:46 -0400 Subject: [PATCH 1/3] fix: correct osv-scanner -> osvScanner, turning OSV scanning ON MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `.coderabbit.yaml` has configured `reviews.tools.osv-scanner: enabled: true` since the file was written. That is not a key in CodeRabbit's v2 schema. The schema's `tools` object allows additional properties, so the misspelling was accepted silently and OSV dependency scanning has never run in this repo — the config READ as an enabled security scanner while gating nothing. Verified against the live schema rather than from memory (storage.googleapis.com/coderabbit_public_assets/schema.v2.json, fetched 2026-08-06): its 57 `reviews.tools` keys include `osvScanner` and do not include `osv-scanner`. Found by the RF.P6 fleet census (wave-av/claude-workstation#1995), which classifies a config surface as `inert` when it carries a key the vendor's schema silently drops. 12 live repos carry this same misspelling; this is one of them, shipping as its own PR so the before/after finding count is attributable per repo. This turns a security scanner ON. Expect new dependency-vulnerability findings on the next review here — that is the point, and they are pre-existing exposures that were simply never being reported. Refs wave-av/claude-workstation#1083 Co-Authored-By: Claude Opus 5 --- .coderabbit.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 46b1cef..a7aeb7b 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -89,7 +89,12 @@ reviews: enabled: true semgrep: enabled: true - osv-scanner: + # The schema key is `osvScanner`, camelCase. This read `osv-scanner` since the file was + # written; `tools` allows additional properties, so CodeRabbit accepted the misspelling + # silently and ran no OSV scanning at all. Verified against the live v2 schema + # (storage.googleapis.com/coderabbit_public_assets/schema.v2.json, 2026-08-06): the 57 tool + # keys include `osvScanner` and do not include `osv-scanner`. (#1083) + osvScanner: enabled: true shellcheck: enabled: true From 32ec516f7a2366f1c6667f43df91c4bad3c535aa Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Thu, 6 Aug 2026 19:19:28 -0400 Subject: [PATCH 2/3] fix: correct github_checks -> github-checks, same inert-key class The schema key is `github-checks` (hyphenated). `github_checks` was silently accepted and ignored, so GitHub Checks ran on its 90s default rather than the 900s configured here. Verified against the live v2 schema (2026-08-06). Refs wave-av/claude-workstation#1083 --- .coderabbit.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index a7aeb7b..e6b4ff3 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -110,7 +110,12 @@ reviews: enabled: true packages: - "ast-grep-essentials" - github_checks: + # Same inert-key class as `osvScanner` above: the schema key is `github-checks` + # (hyphenated), not `github_checks`, so this block was silently accepted and ignored — + # GitHub Checks integration ran on its 90s default, not the 900s configured here. + # Verified against the live v2 schema (2026-08-06), which defines `github-checks` with + # `enabled` and `timeout_ms` (max 900000). (#1083) + github-checks: enabled: true timeout_ms: 900000 From a1cf33ae7c97dbe579de043e6718ccf7d30b3e4b Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Fri, 7 Aug 2026 09:00:17 -0400 Subject: [PATCH 3/3] chore: re-trigger review on the current head The macroscope approval on this PR was dismissed by dismiss_stale_reviews when the branch was updated to pick up main. main requires 1 approving review with enforce_admins on, and the PR author cannot self-approve, so the PR sat green and unmergeable with no reviewer able to act. Empty commit: no content change to the diff, purely to give the reviewer a new head to review. The osv-scanner -> osvScanner and github_checks -> github-checks renames are unchanged.