[fix/nanoid-osv-supply-chain] Bump postcss + run Supply Chain scan daily with Slack alerting

[NiveditJain]

Summary

• nanoid fix: the Supply Chain workflow (OSV-Scanner) was failing on main and on open PRs: nanoid@3.3.16 (transitively pinned via the postcss override) has a high-severity advisory, GHSA-2v37-7h3g-55p8, fixed in 3.3.17. Bumps the postcss override in package.json from 8.5.23 → 8.5.26, which itself requires nanoid@^3.3.17 — bun install resolved nanoid@3.3.18, no new direct dependency added.
• Scanner cadence + alerting: the scheduled OSV-Scanner run only fired weekly, and a red scheduled run on main had no PR author to notice it — this is literally how the nanoid advisory above went unseen until it happened to fail a PR. .github/workflows/osv-scanner.yml now runs the scan daily. Only the schedule run posts to Slack on a failed scan — PR and push runs stay silent, since those failures are already visible to whoever opened or merged the PR. Posting is optional: it no-ops when SLACK_WEBHOOK_URL isn't set, reusing the same webhook + node -e | curl idiom integration-suite/run.sh already uses.
• SECURITY.md and CHANGELOG.md updated to match.

Test plan

• bun install — lockfile diff is minimal (only postcss/nanoid bumped)
• Ran OSV-Scanner locally via the same Docker image CI uses (ghcr.io/google/osv-scanner-action:v2.3.8) — No issues found, exit 0
• bun run test:run — same 15 pre-existing failures as on unmodified main (unrelated localStorage jsdom issue in project-list.test.tsx), no new failures introduced by this change
• Validated osv-scanner.yml's YAML with yaml.parse, and the notify step's shell body with bash -n, after each edit
• Slack POST itself isn't exercised by CI (no failure to trigger it) — verified by code review; will confirm live on the first real scheduled failure

Review history (CodeRabbit)

1. CHANGELOG.md#PR placeholder → filled in (#670).
2. Slack condition would have also fired on a failed push run, contradicting the accompanying comment → narrowed to github.event_name == 'schedule' only, pinned to the scan step's own outcome.
3. Two real bugs in the notify step:
   • The if: condition had no failure()/always()/cancelled() in it, so GitHub implicitly ANDs any custom if: with success() — the step would have been silently skipped every time, since it's only meant to run once the job has already failed. Added failure() explicitly.
   • The webhook POST's exit code was captured but never acted on past a warning echo, so a broken webhook still exited 0 — a failure this feature exists to catch would itself go unnoticed. Now retries 3× and exits nonzero after exhausting retries.

🤖 Generated with Claude Code

Hermes review

Field	Value
Status	Approved
Reviewed commit	a691442721ee8421a1535ddb643c428c1fa7d889
Policy revision	e9d8b194ce8f3af9af7299a08c77fa993512814b
Model	gpt-5.6-terra
Duration	194s
Updated	2026-08-10T08:21:21.280874493+00:00

Summary

No actionable defects found. The dependency override and lockfile consistently resolve the patched PostCSS/nanoid versions, and the scheduled-only Slack path correctly runs after an OSV scan failure, retries boundedly, and fails visibly after exhaustion.

Changes

• Updates the PostCSS override and resolved nanoid version to clear the advisory.
• Changes OSV scanning from weekly to daily.
• Adds optional Slack notification for failed scheduled OSV scans.
• Documents the scan cadence, Slack setup, and release notes.

Validation

• Passeddocker run --rm --network=none -v /review/input/workspace:/workspace:ro -w /workspace oven/bun:latest bun -e '<parse osv-scanner.yml and assert notify condition>' — Workflow YAML parsed successfully and retained the intended failure(), scan-outcome, and schedule condition. (8s)
• Passeddocker run --rm --network=none -v /review/input/workspace:/workspace:ro node:22-bookworm-slim bash -lc '<extract notify body; bash -n>' — The added notification shell body passed Bash syntax validation. (9s)
• Passeddocker run --rm --network=none -v /review/input/workspace:/workspace:ro node:22-bookworm-slim bash -lc '<mock curl responses and execute notify body>' — The notification body exited successfully for HTTP 200 and failed after three mocked HTTP 500 responses. (0s)
• SkippedLive scheduled GitHub Actions OSV scan and Slack delivery — Requires GitHub event dispatch and the repository Slack secret, which are unavailable in this harness. (0s)

Findings

None.

Open questions

None.

Policy overrides

None.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR updates the postcss override to 8.5.26. It changes OSV-Scanner to run daily and adds optional Slack notifications for scheduled scan failures. Documentation and the changelog record these changes.

Changes

Dependency and security workflow updates

Layer / File(s)	Summary
Update dependency override and release notes package.json, CHANGELOG.md	The postcss override changes to 8.5.26. The changelog records the related nanoid update and resolved OSV advisory.
Run daily scans and notify Slack .github/workflows/osv-scanner.yml, SECURITY.md	The workflow runs daily and posts failure details to Slack when configured. Security documentation describes webhook setup and missing-secret behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• FailproofAI/failproofai#391: Updates the OSV-Scanner workflow and related security configuration.

Poem

A rabbit patches PostCSS tonight,
Nanoid hops to safer light.
Daily scans now watch the gate,
Slack reports when troubles wait.
The changelog marks the date.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	The description links the addressed GHSA advisory and references the related review change.
Out of Scope Changes check	✅ Passed	The dependency, workflow, security documentation, and changelog changes are within the stated pull request objectives.
Title check	✅ Passed	The title clearly summarizes the dependency update, daily OSV scanning, and Slack alerting changes.
Description check	✅ Passed	The description clearly explains the dependency fix, workflow changes, documentation updates, testing, and review history.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 6: Update the changelog entry’s trailing `#PR` placeholder with the actual
numeric pull request identifier, preserving the existing dependency-update
description and formatting.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e07d41cb-9567-4d46-853c-ab7f72af5480

📥 Commits

Reviewing files that changed from the base of the PR and between 822022f and eac91f0.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

[NiveditJain]

@hermes-exosphere review this

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/osv-scanner.yml:
- Around line 9-17: Add an identifier to the OSV scan step, then update the
Slack notification step’s condition to run only when that scan failed and the
workflow event is scheduled. Ensure pull request, push, and workflow_dispatch
failures do not trigger Slack notifications.
In `@CHANGELOG.md`:
- Line 7: Update the changelog entry for the Supply Chain workflow to clarify
that Slack notifications for failed OSV-Scanner runs are optional, sent only for
non-pull_request events, and require SLACK_WEBHOOK_URL to be configured;
preserve the existing scheduling and failure context.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 86f6eb50-be27-49b9-89a6-bbc2abc163e4

📥 Commits

Reviewing files that changed from the base of the PR and between a295f95 and f43bc85.

📒 Files selected for processing (3)

• .github/workflows/osv-scanner.yml
• CHANGELOG.md
• SECURITY.md

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/osv-scanner.yml (1)

80-84: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Fail visibly when Slack delivery fails.

At Lines 80-84, network errors and non-200 responses only produce a warning. The final echo returns zero, so the notification step succeeds even when Slack does not accept the alert. Add bounded retries and exit nonzero after the final failed attempt.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/osv-scanner.yml around lines 80 - 84, Update the Slack
webhook POST block in the workflow to retry delivery a bounded number of times,
treating network errors and non-200 responses as failures; after the final
unsuccessful attempt, exit nonzero so the notification step fails visibly, while
preserving the success message and immediate success path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/osv-scanner.yml:
- Around line 15-19: Update the Slack notification step’s if condition to
explicitly include failure() alongside the existing schedule and webhook-secret
checks, so it runs after scheduled OSV scan failures while remaining skipped for
non-scheduled runs or when the secret is unavailable.
---
Outside diff comments:
In @.github/workflows/osv-scanner.yml:
- Around line 80-84: Update the Slack webhook POST block in the workflow to
retry delivery a bounded number of times, treating network errors and non-200
responses as failures; after the final unsuccessful attempt, exit nonzero so the
notification step fails visibly, while preserving the success message and
immediate success path.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6da11654-e460-40b7-b9bc-c8b03dcaa8a2

📥 Commits

Reviewing files that changed from the base of the PR and between f43bc85 and 6f4a19e.

📒 Files selected for processing (2)

• .github/workflows/osv-scanner.yml
• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

[NiveditJain]

@hermes-exosphere review this PR.

[hermes-exosphere]

Hermes

Status	Reviewing
Verdict	Not reviewed yet
Head	a691442721ee
Rounds	0 of 5

No summary yet.

What this changes

No component map for this revision.

Rounds

No review has finished on this pull request yet.

Findings

Nothing raised yet.

---

@hermes-exosphere help lists every command. This comment is maintained in place — I rewrite it after each review rather than posting a new one.

[hermes-exosphere]

Hermes

Status	Reviewed
Verdict	Approved
Head	a691442721ee
Rounds	0 of 5

No actionable defects found. The dependency override and lockfile consistently resolve the patched PostCSS/nanoid versions, and the scheduled-only Slack path correctly runs after an OSV scan failure, retries boundedly, and fails visibly after exhaustion.

What this changes

flowchart LR
n0Dependencyresolution["~ Dependency resolution"]
n1SupplychainCIworkflow["~ Supply-chain CI workflow"]
n2Slackwebhooknotification["Slack webhook notification"]
n3Securitydocumentation["~ Security documentation"]
n0Dependencyresolution -- "provides lockfiles to scan" --> n1SupplychainCIworkflow
n1SupplychainCIworkflow -- "posts scheduled scan failures" --> n2Slackwebhooknotification
n3Securitydocumentation -- "documents operation and setup" --> n1SupplychainCIworkflow

Loading

Rounds

Round	Reviewed	Commits in this round	Verdict
0	a691442721ee	03ef397bc33deac91f098d3ca295f95e32ac0467c4e52819f43bc85061946f4a19efc88da691442721ee	Approved

Findings

Nothing raised yet.

---

@hermes-exosphere help lists every command. This comment is maintained in place — I rewrite it after each review rather than posting a new one.

[hermes-exosphere]

Hermes found no blocking issues in this revision.