Repository navigation
supply_chain_check: reachability tags on osv rows - #2110
Merged
Merged
Conversation
…itive) An osv row for an npm package no source file imports now prints "(reach: dev-only|transitive)". Only dev-only rows skip the --fail-on gate (unless SUPPLY_CHAIN_STRICT=1); transitive rows still gate because a direct dependency may reach them. Unknown reach (unreadable file, lockfile without a packages map, non-npm ecosystem, PyPI without a dev group) is gated. The lockfile is authoritative for npm dev-ness. Only a root-level .venv/venv/vendor is pruned from the import scan; .astro and .mdx files and backtick specifiers are scanned. Replaces the old dev-only cap at moderate. The osv API fallback now emits the ecosystem so it gets the same tags. Tests: 5/5 (test_supply_chain_reach 5; test-scanner-offline-db, test-supply-chain-osv-fallback, test-supply-chain-check pass) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
osv-scanner rows from
supply_chain_check.shnow carry a reachability tag, which closes the pilot gap where flagged npm packages gave no signal about whether app code uses them.imported: a JS/TS/Vue/Svelte/Astro/MDX file outsidenode_modules,.gitand root-levelvendor/venv/.venvimports or requires the package (static, dynamic or backtick form).dev-only: every lockfile occurrence is"dev": true, or osv puts it in a dev/build/test group (npm prod keys never fall through to the osv group).transitive: everything else.Only
dev-onlyrows skip the--fail-ongate (SUPPLY_CHAIN_STRICT=1gates them too);importedandtransitiveboth gate, since a prod transitive dependency is reachable through the direct dependency that imports it. The summary says how many rows were downgraded. An unreadable file, a lockfile without apackagesmap (v1), or a non-npm ecosystem fails closed. PyPI is downgraded only by a dev group, never by missing imports, because distribution names differ from module names. The osv API fallback now emits the ecosystem so the same tags apply.Verification
python3 scripts/test_supply_chain_reach.py: 5/5 locally (v1 lockfile, backtick import,.astro, nestedvendor, prod key vs osv dev group).test-scanner-offline-db.sh,test-supply-chain-osv-fallback,test-supply-chain-checkpass locally.skill_index.py --check,ci-gates.sh size-ratchet --base origin/mainandfragmentspass locally.🤖 Generated with Claude Code