ci: scope whole-tree CVE scanning off the pull-request path - #136
Merged
Conversation
The npm audit and OSV gates were failing every open PR whenever a new transitive advisory dropped in dev/build tooling (esbuild, ws, undici in quick succession) — advisories the PRs never touched. A PR check should test what the PR changes; whole-tree security posture belongs on main. - Move npm audit into a dedicated Dependency Audit job that runs on push-to-main, a weekly schedule, and manual dispatch — not on PRs. - Take SBOM/Grype off the PR path too and make Grype non-blocking (fail-build: false); npm audit is the single blocking CVE gate. - Remove the redundant OSV Scanner job. This also drops the only unpinned reusable workflow, clearing the way to re-enable the 'require SHA-pinned actions' repo setting. - PRs remain vuln-gated by Dependency Review (diff-scoped) + GuardDog; Dependabot alerts/auto-PRs drive remediation; push-to-main still gates deploy, so production protection is unchanged. - Tighten workflow-level permissions to contents:read (actions:read and workflow-level security-events:write existed only for the OSV call). Branch-protection required checks must drop 'OSV Scanner / osv-scan' and 'SBOM & Grype Scan' (they no longer run on PRs); SECURITY.md updated to match.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Three times running (esbuild → ws → undici), a freshly-published advisory in transitive dev/build tooling has red-X'd every open Dependabot PR at once via the
npm auditand OSV gates — for advisories the PRs never touched. The build had three redundant whole-tree CVE scanners (npm audit, OSV, Grype), each able to fail independently on the same advisory, all on the PR path.A PR check should test what the PR changes. Whole-tree security posture belongs on
main+ a schedule, where Dependabot's own alerts/auto-PRs already drive remediation.Change
npm auditmoves into a dedicatedDependency Auditjob that runs on push-to-main, a weekly schedule, and manual dispatch — not on PRs. It stays the single blocking CVE gate and still gates the deploy.fail-build: false) — it now contributes its independent vuln DB to the Security tab without being a second gate. Syft SBOM artifact is retained.npm audit. Bonus: it was the only unpinned reusable workflow, so dropping it clears the way to re-enable the “require SHA-pinned actions” repo setting (the deferred item in the security config).contents: read(theactions: read/ workflow-levelsecurity-events: writeexisted only for the OSV reusable-workflow call).SECURITY.mdis updated throughout to match.Branch-protection required status checks must drop
OSV Scanner / osv-scanandSBOM & Grype Scan— both no longer run on PRs, so leaving them required would block all future PRs (and this one). New required set:Build & Test,GuardDog Supply Chain Scan,Dependency Review,CodeQL.Net effect
Deploy-time protection is identical; a vuln a PR introduces still blocks that PR; but a new advisory in unrelated dev tooling no longer breaks every open PR — it surfaces via Dependabot + the push/scheduled scan instead.