GITGUD

neiam neiam /gitgud

Git Gud

public · Issues · Pulls · Labels · Forks · Compare · Actions success · Badges · Packages

⭐ 1

Log in to mark this repository.

Advisories C1: dependency alerts, scanned on push, on a Security tab

8389210 · Gabriel Morell · 2026-10-23 04:40

95 files +1490 -13
Message 
{commit_body(@commit)}

Files changed

modified README.md
+3 −0
@@ -259,6 +259,9 @@ These all live in `config/*.exs`. Key ones:
259 259 | `GITGUD_WEBHOOK_ALLOW_PRIVATE` (env) | The same for webhook delivery (`:webhook`). Webhooks pointing at a LAN host stop delivering until this is set | unset |
260 260 | `GITGUD_FEDERATION_ALLOW_PRIVATE` (env) | The same for ActivityPub actor fetches and inbox delivery (`:federation`) | unset |
261 261 | `GitGud.Audit` `retention_days` | Audit log entries older than this many days are pruned daily. Config only, not an admin setting, so shortening the trail takes a deploy; boot refuses anything but `nil` or a positive integer | `nil` (kept forever) |
262 +| `GitGud.Advisories` `source` | Dependency alerts: `:mirror` keeps OSV's dumps on the instance (nothing leaves it), `:api` asks api.osv.dev (which sees each scan's package names and versions), `:off` turns the feature off whatever orgs chose. Orgs and personal repositories still turn it on themselves | `:mirror` |
263 +| `GITGUD_OSV_SCANNER` (env) → `GitGud.Advisories` `scanner` | Where osv-scanner is. Not bundled: otherwise `/usr/libexec/gitgud/osv-scanner`, then `PATH`. Without one, nothing is scanned and the Security page says so. On Kubernetes, an init container copies it from `ghcr.io/google/osv-scanner` (pin the digest) into an `emptyDir` — see docs/plans/dependency-security.md | unset |
264 +| `GITGUD_OSV_DB_DIR` (env) → `GitGud.Advisories` `db_dir` | Where the `:mirror` source keeps OSV's dumps, per ecosystem (Hex + crates.io ≈ 5 MB; npm ≈ 210 MB on disk, ~600 MB of memory while a scan reads it) | `.osv-db` in the repositories directory |
262 265 | `GitGud.Workflows.Workers.StaleJobReaper` `stale_after_minutes` | A `running` job whose runner hasn't sent an `UpdateTask` or `UpdateLog` (`heartbeat_at`) for this long is re-queued | `5` |
263 266 | `GitGud.Packages.Token` `private_key_pem` | RS256 PEM that signs OCI registry Bearer tokens (env: `GITGUD_REGISTRY_PRIVATE_KEY`) | `nil` (registry auth disabled) |
264 267 | `GitGud.Packages.Token` `issuer` / `audience` / `key_id` / `ttl_seconds` | JWT claim defaults zot must agree on | `gitgud-registry` / `container_registry` / `gitgud-registry-1` / `300` |
modified config/config.exs
+4 −1
@@ -48,7 +48,10 @@ config :git_gud, Oban,
48 48 # Imports shell out to `git clone` against a remote forge; keep the
49 49 # lane narrow so a big org import doesn't saturate the box or trip
50 50 # the provider's rate limit.
51 − imports: 2
51 + imports: 2,
52 + # Dependency alert scans, one at a time: each loads OSV's dumps for
53 + # the ecosystems it needs (GitGud.Advisories.Workers.Scan).
54 + advisories: 1
52 55 ],
53 56 plugins: [
54 57 {Oban.Plugins.Cron,
modified docs/plans/dependency-security.md
+19 −6

Click to load diff…

added lib/git_gud/advisories.ex
+282 −0

Click to load diff…

added lib/git_gud/advisories/alert.ex
+59 −0

Click to load diff…

added lib/git_gud/advisories/scanner.ex
+233 −0

Click to load diff…

added lib/git_gud/advisories/workers/scan.ex
+47 −0

Click to load diff…

modified lib/git_gud/audit/catalog.ex
+6 −0

Click to load diff…

modified lib/git_gud/organizations/organization.ex
+3 −0

Click to load diff…

modified lib/git_gud/repositories/repository.ex
+5 −0

Click to load diff…

modified lib/git_gud/repositories/workers/commit_backfill.ex
+6 −2

Click to load diff…

modified lib/git_gud_web/components/audit_components.ex
+12 −0

Click to load diff…

modified lib/git_gud_web/live/audit_live/repo.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/branch_protection_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/deploy_key_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/interaction_policy_live/edit.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/issue_live/history.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/issue_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/issue_live/new.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/issue_live/show.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/job_token_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/label_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/org_live/settings_profile.ex
+52 −1

Click to load diff…

modified lib/git_gud_web/live/pr_live/files.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/pr_live/history.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/pr_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/pr_live/new.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/pr_live/reviews.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/pr_live/show.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/registry_token_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/blob.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/commit.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/committers.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/compare.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/fork.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/forks.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/header.ex
+28 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/languages.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/log.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/merge.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/moderation.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/packages.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/settings.ex
+57 −1

Click to load diff…

modified lib/git_gud_web/live/repo_live/settings_runners.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/show.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/repo_live/tree.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/secrets_live/repo.ex
+1 −0

Click to load diff…

added lib/git_gud_web/live/security_live/repo.ex
+189 −0

Click to load diff…

modified lib/git_gud_web/live/webhook_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/wiki_live/edit.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/wiki_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/wiki_live/show.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/workflow_live/index.ex
+1 −0

Click to load diff…

modified lib/git_gud_web/live/workflow_live/show.ex
+3 −2

Click to load diff…

modified lib/git_gud_web/router.ex
+4 −0

Click to load diff…

added priv/repo/migrations/20261023041839_create_security_alerts.exs
+51 −0

Click to load diff…

added test/git_gud/advisories_test.exs
+227 −0

Click to load diff…

added test/git_gud_web/live/security_live_test.exs
+163 −0

Click to load diff…

Parents: 4ad7ecf