Uh oh!
There was an error while loading. Please reload this page.
fix vulnerability triage for reusable callers - #1515
Conversation
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughChangesThe vulnerability triage workflow now supports explicit CodeQL bypasses, checks out pinned reusable assets, routes Linear GraphQL requests through a retry-aware helper, and preserves classification behavior when CodeQL is unavailable. Vulnerability triage workflow
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant TriageWorkflow
participant LinearRequestHelper
participant LinearAPI
Caller->>TriageWorkflow: invoke workflow with skip_codeql
TriageWorkflow->>LinearRequestHelper: pipe GraphQL payload
LinearRequestHelper->>LinearAPI: POST request
alt transient or non-JSON response
LinearAPI-->>LinearRequestHelper: failure response
LinearRequestHelper->>LinearAPI: retry request
else valid JSON response
LinearAPI-->>LinearRequestHelper: JSON response
LinearRequestHelper-->>TriageWorkflow: return response
end
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 12: Move the vulnerability triage entry for reusable-workflow callers and
repositories without CodeQL from its current changelog section to the bottom of
the appropriate “### Fixed” section, preserving the existing text and link.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 2f3d5d72-5286-4bcf-b9c2-ac42b22f78eb
📒 Files selected for processing (3)
.github/scripts/test-vulnerability-triage.sh.github/workflows/vulnerability-triage.ymlCHANGELOG.md
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/vulnerability-triage.yml (1)
423-426: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDo not treat skipped CodeQL as an empty snapshot.
Writing
[]removes everycodeql:finding fromfindings.json; the later reconciliation can therefore close existing CodeQL-managed Linear issues even though CodeQL was unavailable. Preserve those issues duringskip_codeqlruns (for example, classify them as ignored) and add a regression case.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/vulnerability-triage.yml around lines 423 - 426, Update the SKIP_CODEQL branch in the CodeQL workflow so an unavailable scan does not write an empty snapshot that causes existing CodeQL-managed findings to be closed. Preserve those findings through reconciliation by marking them ignored or otherwise retaining their prior state, and add a regression test covering skip_codeql behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/linear-graphql-request.sh:
- Around line 37-55: Update the retry flow in the Linear GraphQL request script
to avoid replaying mutations after curl failures or transient HTTP responses.
Detect whether the submitted GraphQL operation is read-only, retry only queries,
and return the mutation response/error without automatic retries; alternatively,
implement an idempotency/deduplication mechanism with a re-read before retrying
mutations. Preserve the existing retry behavior for safe queries.
In @.github/workflows/vulnerability-triage.yml:
- Around line 903-904: Update the issue-creation flow invoking
linear-graphql-request.sh so retries are idempotent: use Linear’s supported
idempotency mechanism for issueCreate, or after an ambiguous failure re-query
for the deterministic issue title and reuse the existing issue before retrying
creation. Preserve normal retry behavior for failures where no issue was
created.
---
Outside diff comments:
In @.github/workflows/vulnerability-triage.yml:
- Around line 423-426: Update the SKIP_CODEQL branch in the CodeQL workflow so
an unavailable scan does not write an empty snapshot that causes existing
CodeQL-managed findings to be closed. Preserve those findings through
reconciliation by marking them ignored or otherwise retaining their prior state,
and add a regression test covering skip_codeql behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5a281b46-8840-4ba0-938f-75bcfa480bd5
📒 Files selected for processing (4)
.github/scripts/linear-graphql-request.sh.github/scripts/test-vulnerability-triage.sh.github/workflows/vulnerability-triage.ymlCHANGELOG.md
🚧 Files skipped from review as they are similar to previous changes (1)
- CHANGELOG.md
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/scripts/test-vulnerability-triage.sh (1)
25-34: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winUse structural YAML assertions for the workflow contract.
assert_workflow_contains()only checks whether text appears anywhere in the file, so a commented-out or unrelated occurrence could satisfy the repository, SHA, or helper-reference checks while the active workflow remains incorrect. Parse the YAML and assert the relevant action step inputs/commands directly.Also applies to: 36-41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/test-vulnerability-triage.sh around lines 25 - 34, Replace the text-based checks in assert_workflow_contains with structural YAML validation of the active workflow. Parse WORKFLOW_FILE and assert the relevant action step inputs and run commands directly, ensuring repository, SHA, and helper references cannot be satisfied by comments or unrelated occurrences; update all callers of assert_workflow_contains accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/scripts/test-vulnerability-triage.sh:
- Around line 25-34: Replace the text-based checks in assert_workflow_contains
with structural YAML validation of the active workflow. Parse WORKFLOW_FILE and
assert the relevant action step inputs and run commands directly, ensuring
repository, SHA, and helper references cannot be satisfied by comments or
unrelated occurrences; update all callers of assert_workflow_contains
accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 321d3a50-b29e-427f-b708-b2ccc7c57bb2
📒 Files selected for processing (3)
.github/scripts/linear-graphql-request.sh.github/scripts/test-vulnerability-triage.shCHANGELOG.md
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/scripts/linear-graphql-request.sh
- CHANGELOG.md
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 9bdf113. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Summary
skip_codeqlcontract for private callers where GitHub Code Security is unavailableRoot cause
Reusable workflow jobs check out the caller repository, so the reconciliation filters added in #1505 were absent in
zoektandsourcebot-helm-chart. Private repositories without GitHub Code Security return HTTP 403 for CodeQL alert lookup, which the fail-closed check correctly rejected but could not distinguish from an authorization error.Validation
.github/scripts/test-vulnerability-triage.shgit diff --checkvulnerability-alertspermission andjob.workflow_*contextsNote
Medium Risk
Changes affect automated Linear issue create/close/reconcile behavior and CI security triage; mistakes could leave stale issues open or close the wrong ones, though mutations are not retried and tests cover the new paths.
Overview
Fixes vulnerability triage when the workflow runs as a reusable job: the triage job now checks out
.github/scriptsfrom the called workflow repo atjob.workflow_sha, so jq helpers and the Linear client match the workflow revision instead of missing on caller repos likezoekt.Adds a
skip_codeqlworkflow_callinput for repos where code scanning is unavailable (e.g. private repos without GitHub Code Security). When set, CodeQL alert checks and fetches are skipped, empty CodeQL findings are written, and reconciliation ignores existingcodeql:Linear issues instead of auto-closing them; other findings still reconcile. Non-404/200 CodeQL API failures remain fail-closed when CodeQL is not skipped.Introduces
linear-graphql-request.shfor all Linear GraphQL calls: queries retry on transient HTTP/non-JSON responses; mutations run once to avoid duplicate writes. Create/reopen/close steps handle transport failures without treating them as success.test-vulnerability-triage.shnow asserts workflow wiring, Linear retry behavior, and CodeQL-skipped classification.Reviewed by Cursor Bugbot for commit 1017659. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
skip_codeqloption to explicitly bypass CodeQL-dependent alert checks when unavailable.