fix(security): eliminate clean-scan warning output - #690
Conversation
|
Warning Review limit reached
Next review available in: 23 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthrough보안 스캔 워크플로가 OSV의 새 출력 옵션을 사용합니다. Synthetic merge 커밋을 SARIF 업로드 전에 checkout하고 검증합니다. Trivy 진행률 출력을 숨깁니다. 관련 계약 테스트를 갱신하고 추가합니다. Changes보안 스캔 계약
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant SecurityWorkflow
participant GitRepository
participant OSVScanner
participant OSVReporter
participant CodeScanning
SecurityWorkflow->>GitRepository: synthetic merge 커밋 checkout
SecurityWorkflow->>OSVScanner: old/head 결과를 파일로 생성
OSVScanner-->>SecurityWorkflow: OSV 결과 파일 반환
SecurityWorkflow->>OSVReporter: SARIF 및 annotation 출력 지정
OSVReporter-->>SecurityWorkflow: results.sarif 생성
SecurityWorkflow->>GitRepository: github.sha 및 커밋 객체 검증
SecurityWorkflow->>CodeScanning: 검증 성공 시 SARIF 업로드
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
tests/test_required_workflow_queue_contract.py (2)
933-938: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win레거시 Reporter 인자를 계약 테스트에서 금지하세요.
현재 테스트는
--output변형만 거부합니다.--gh-annotations=true가 workflow에 남아도 테스트가 통과합니다.
--output-files=gh-annotations:#stderr``의 존재와--gh-annotations=true의 부재를 함께 단언하세요.수정 예시
assert "--output-files=results.sarif" in workflow + assert "--output-files=gh-annotations:`#stderr`" in workflow ... + assert "--gh-annotations=true" not in workflow🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_required_workflow_queue_contract.py` around lines 933 - 938, Update the workflow contract assertions in the shown test to require `--output-files=gh-annotations:`#stderr`` and reject `--gh-annotations=true`, alongside the existing legacy `--output` exclusions.
954-959: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win검증 성공 여부를 테스트하세요.
현재 단언은 단계의 텍스트 순서만 확인합니다. Reporter 실패 후 검증 단계가 실행되는지, 검증 실패 시 SARIF 업로드가 차단되는지는 확인하지 않습니다.
검증 단계의
id와 실패 후 실행 조건, 그리고 업로드 조건의steps.verify_merge_commit.outcome == 'success'를 단언하세요. (docs.github.com)수정 예시
+ assert "id: verify_merge_commit" in merge_verify_step + assert "hashFiles('results.sarif')" in merge_verify_step + assert "steps.verify_merge_commit.outcome == 'success'" in workflow🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_required_workflow_queue_contract.py` around lines 954 - 959, Update the workflow assertions around the synthetic merge verification steps to validate behavior, not only textual ordering: assert each verification step has the expected id, runs after reporter failure via its failure condition, and gates SARIF upload with steps.verify_merge_commit.outcome == 'success'. Preserve the existing ordering assertions..github/workflows/security-scan.yml (1)
205-205: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winOSV Reporter의 deprecated annotation 옵션을 새 출력 형식으로 전환하세요.
osv-reporterv2.3.8은--gh-annotations=true를 deprecated로 표시합니다.--output-files=gh-annotations:#stderr``를 추가하고 기존 옵션을 제거하세요. 계약 테스트도 두 조건을 단언해야 합니다.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security-scan.yml at line 205, osv-reporter의 deprecated annotation 옵션을 새 출력 형식으로 교체하세요. .github/workflows/security-scan.yml 205-205에서는 기존 --gh-annotations=true를 제거하고 --output-files=gh-annotations:`#stderr를` 추가하세요. tests/test_required_workflow_queue_contract.py 933-938의 계약 테스트는 새 옵션이 포함되고 deprecated 옵션이 제거된다는 두 조건을 모두 단언하도록 갱신하세요.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security-scan.yml:
- Around line 233-246: In .github/workflows/security-scan.yml lines 233-246, add
id: verify_merge_commit and if: always() to the synthetic merge verification
step, then require steps.verify_merge_commit.outcome == 'success' in the SARIF
upload condition so failures and skips prevent uploading. In
tests/test_required_workflow_queue_contract.py lines 954-959, add assertions
covering the verification step identifier and the upload success condition.
---
Nitpick comments:
In @.github/workflows/security-scan.yml:
- Line 205: osv-reporter의 deprecated annotation 옵션을 새 출력 형식으로 교체하세요.
.github/workflows/security-scan.yml 205-205에서는 기존 --gh-annotations=true를 제거하고
--output-files=gh-annotations:`#stderr를` 추가하세요.
tests/test_required_workflow_queue_contract.py 933-938의 계약 테스트는 새 옵션이 포함되고
deprecated 옵션이 제거된다는 두 조건을 모두 단언하도록 갱신하세요.
In `@tests/test_required_workflow_queue_contract.py`:
- Around line 933-938: Update the workflow contract assertions in the shown test
to require `--output-files=gh-annotations:`#stderr`` and reject
`--gh-annotations=true`, alongside the existing legacy `--output` exclusions.
- Around line 954-959: Update the workflow assertions around the synthetic merge
verification steps to validate behavior, not only textual ordering: assert each
verification step has the expected id, runs after reporter failure via its
failure condition, and gates SARIF upload with steps.verify_merge_commit.outcome
== 'success'. Preserve the existing ordering assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: fdf4b60a-2f98-4927-a5b5-e92f2661bf2f
📒 Files selected for processing (2)
.github/workflows/security-scan.ymltests/test_required_workflow_queue_contract.py
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
01ae539 to
8159c9b
Compare
Pull request was closed
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heada2e8f1b9d367fa1462f29f9dfb0a3966fa00263d. -
Head SHA:
a2e8f1b9d367fa1462f29f9dfb0a3966fa00263d -
Workflow run: 30806755497
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_required_workflow_queue_contract.py"]
R2 --> V2["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_required_workflow_queue_contract.py"]
R2 --> V2["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heada2e8f1b9d367fa1462f29f9dfb0a3966fa00263d. -
Head SHA:
a2e8f1b9d367fa1462f29f9dfb0a3966fa00263d -
Workflow run: 30806755497
-
Workflow attempt: 2
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_required_workflow_queue_contract.py"]
R2 --> V2["targeted test run"]
a2e8f1b to
66342f8
Compare
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current heade1b869ee30dedc0251256035e4787c0f80444ec2. -
Head SHA:
e1b869ee30dedc0251256035e4787c0f80444ec2 -
Workflow run: 30828701073
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_required_workflow_queue_contract.py"]
R2 --> V2["targeted test run"]
![pr-auto-rebase[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
e1b869e to
579a2b2
Compare
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head579a2b20344ea49414952390b6e1333e4e4c3081. -
Head SHA:
579a2b20344ea49414952390b6e1333e4e4c3081 -
Workflow run: 30836836191
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_required_workflow_queue_contract.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_required_workflow_queue_contract.py"]
R2 --> V2["targeted test run"]
|
Closing this pre-baseline branch to reduce source-repository workflow fan-out. The warning-free security-scan CLI/output contract remains in the consolidated post-#731 replay queue and should be rebuilt from repaired current main with the same fail-closed SARIF and merge-preview provenance checks. |
1 participant
Closes #689
What changed
--outputarguments with--output-file--output-filesformhide-progressinput while preserving explicit Medium+ SARIF parsing and fail-closed gatingupload-sarifno longer emits a localfatal: bad objectfallbackVerification
python3 -m pytest --cov=scripts/ci --cov-report=term-missing: 796 passed; 100% coverage (6407/6407 statements)python3 -m interrogate -v --fail-under 100 scripts/ci: 100% (567/567)ruff check .actionlint .github/workflows/security-scan.yml(shellcheck enabled)actionlint -shellcheck=across all workflowsgit diff --check--output-fileThe first local Trivy database attempt hit a mirror timeout; a direct official GHCR database retry completed cleanly. This was isolated as external transport evidence rather than a code finding.
Upstream contracts
Summary by CodeRabbit
버그 수정
개선 사항