Repository navigation
Scanner offline vuln DB, semgrep writable cache, dev-only severity cap - #2094
Closed
remigiusz-antczak wants to merge 1 commit into
Closed
remigiusz-antczak wants to merge 1 commit into
remigiusz-antczak wants to merge 1 commit into
Conversation
review_checks.sh runs osv-scanner and trivy from a pre-seeded DB when the download fails (REVIEW_OSV_DB_DIR, REVIEW_TRIVY_CACHE); a missing or non-DB-artifact dir is reported as NOT CHECKED with the warm command, and supply_chain_check.sh fails (rc 1) in that case. A trivy vuln-DB download failure no longer falls back to secret-only. semgrep gets a temp XDG_CACHE_HOME. supply_chain_check.sh caps findings in dev-only npm packages (every name@version occurrence dev, npm only) at moderate and notes it; actionlint skips when there are no workflow files. Tests: 19/19 scanner-offline-db, 31/31 scanner-sandbox-fallback Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Superseded by #2097 (actionlint not-applicable fix; no force-push). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the scanner coverage gaps found in the first pilot audit, where osv-scanner and trivy couldn't download their vulnerability databases behind a sandboxed proxy and the run lost coverage.
review_checks.shruns osv-scanner and trivy from a pre-seeded database (REVIEW_OSV_DB_DIR,REVIEW_TRIVY_CACHE) when the download fails. A missing directory, or one with no database artifact, is reported as NOT CHECKED along with the command that warms the cache. It never reports clean.XDG_CACHE_HOME, so it runs whenHOMEisn't writable.supply_chain_check.shcaps findings in dev-only npm packages at moderate, and says so in the output. It does this only when everyname@versionoccurrence in the lockfile is dev and the finding comes from npm, so a production package with the same name keeps its severity.Verification
bash scripts/test-scanner-offline-db.sh: 19/19. Covers the prod+dev same-name case, an empty DB failing closed with a nonzero exit, and the "failed to download vulnerability DB" case.bash scripts/ci-tests.d/scanner-sandbox-fallback.sh: 31/31.🤖 Generated with Claude Code