neiam /gitgud

Git Gud

Audit: unfixable findings and pending image updates are warnings

f434216 · Gabriel Morell · 2026-10-27 18:57

3 files +29 -12

Message

{commit_body(@commit)}

modified .forgejo/workflows/audit.yml

+29 −12

@@ -1,10 +1,13 @@

1	1	name: audit
2	2	# Known vulnerabilities in what the forge is built from: every lockfile
3	3	# in the repository (mix.lock, the CLI's and the NIFs' Cargo.lock)
4		−# checked against the OSV database (https://osv.dev). A finding fails
5		−# the run, which is how it gets noticed — the CI page, the panel widget,
6		−# `gg ci list`. Nightly, since advisories land without anyone pushing,
7		−# and by hand from the Actions page.
	4	+# checked against the OSV database (https://osv.dev), sorted by
	5	+# scripts/osv-audit: a finding with a fixed version fails the run, which
	6	+# is how it gets noticed — the CI page, the panel widget, `gg ci list`;
	7	+# one with no fix yet makes the job a warning (its `gitgud-conclusion`
	8	+# output), since there's nothing to do but wait. Nightly, since
	9	+# advisories land without anyone pushing, and by hand from the Actions
	10	+# page.
8	11	#
9	12	# On a pull request it compares the lockfiles the pull request changes
10	13	# with the same files on the base branch: it fails only on a

@@ -16,9 +19,10 @@ name: audit

16	19	# and the app has a version catalog (gradle/libs.versions.toml) only.
17	20	#
18	21	# `image` checks what's deployed rather than what it's built from: the
19		−# published :latest, for Debian security updates it hasn't got. It
20		−# fails on those alone. Debian leaves some CVEs unfixed in a stable
21		−# release, and failing on those would mean failing forever. The fix is
	22	+# published :latest, for Debian security updates it hasn't got. Those
	23	+# alone make it a warning (actionable soon, not an outage: what's
	24	+# running still runs). Debian leaves some CVEs unfixed in a stable
	25	+# release, and warning on those would mean warning forever. The fix is
22	26	# a newer base tag (the Dockerfile's RUNNER_DEBIAN_VERSION, which
23	27	# dependency-updates.yml bumps) or a rebuild. osv-scanner's view of the
24	28	# image, unfixed CVEs included, is printed after it for reading.

@@ -41,6 +45,10 @@ concurrency:

41	45	jobs:
42	46	osv:
43	47	runs-on: self-hosted
	48	+ # `warning` when only unfixable findings remain (scripts/osv-audit).
	49	+ # GitHub and Forgejo read it as an ordinary output.
	50	+ outputs:
	51	+ gitgud-conclusion: ${{ steps.scan.outputs.conclusion }}
44	52	steps:
45	53	- uses: actions/checkout@v4
46	54	with:

@@ -60,11 +68,15 @@ jobs:

60	68	echo "${OSV_SHA256} /tmp/osv-scanner" \| sha256sum -c -
61	69	chmod +x /tmp/osv-scanner
62	70
63		− # Exit 1 when anything is vulnerable, so the run fails; the table
64		− # names each package, its version, and the version that fixes it.
	71	+ # Exit 1 when anything has a fixed version, so the run fails; the
	72	+ # tables name each package, its version, its advisories, and the
	73	+ # version that fixes it or that none does.
65	74	- name: Scan the lockfiles
	75	+ id: scan
66	76	if: github.event_name != 'pull_request'
67		− run: /tmp/osv-scanner scan source --recursive .
	77	+ env:
	78	+ OSV_SCANNER: /tmp/osv-scanner
	79	+ run: python3 scripts/osv-audit --recursive .
68	80
69	81	- name: Scan the lockfiles this pull request changes
70	82	if: github.event_name == 'pull_request'

@@ -94,6 +106,8 @@ jobs:

94	106	image:
95	107	if: github.event_name != 'pull_request'
96	108	runs-on: self-hosted
	109	+ outputs:
	110	+ gitgud-conclusion: ${{ steps.pending.outputs.conclusion }}
97	111	steps:
98	112	# The job's own token reads its repository's image, as build.yml's
99	113	# pushes it.

@@ -105,6 +119,7 @@ jobs:

105	119
106	120	# As root, since the image runs as nobody; apt only reads here.
107	121	- name: Security updates the published image hasn't got
	122	+ id: pending
108	123	env:
109	124	IMAGE: ${{ vars.CI_REGISTRY }}/${{ github.repository }}:latest
110	125	run: \|

@@ -113,10 +128,12 @@ jobs:

113	128	'apt-get update -qq >/dev/null && apt list --upgradable 2>/dev/null \| grep -- -security' \|\| true)
114	129	if [ -n "$pending" ]; then
115	130	echo "$pending"
116		− echo "::error::$(echo "$pending" \| wc -l) Debian security update(s) not in the published image: bump RUNNER_DEBIAN_VERSION, or rebuild."
117		− exit 1
	131	+ echo "::warning::$(echo "$pending" \| wc -l) Debian security update(s) not in the published image: bump RUNNER_DEBIAN_VERSION, or rebuild."
	132	+ echo "conclusion=warning" >> "$GITHUB_OUTPUT"
	133	+ exit 0
118	134	fi
119	135	echo "No Debian security updates pending."
	136	+ echo "conclusion=success" >> "$GITHUB_OUTPUT"
120	137
121	138	- name: Fetch osv-scanner
122	139	if: always()

Parents: 37f03c4