Describe the scoped tag catalogue in OpenAPI, and say why govulncheck keeps its cron-only SARIF category - #1503
Merged
Conversation
… keeps its cron-only category GET /tasks/tags has been scoped by the #1082 own-rows rule and gated on view_tasks since #1501, but docs/openapi.yaml still described a global catalogue; the summary now says what a non-admin user or scoped key gets and who sees the fleet-wide list, in the words the /tasks entry already uses. govulncheck-scheduled.yml uploads under its own category like the weekly Grype scan did before #1502, but the two are not the same shape: ci.yml's govulncheck gate uploads no SARIF, so the cron lane is the only govulncheck upload and GitHub raises no missing-configuration check for it on PRs. The workflow comment and docs/TESTING.md record that so the category is not renamed by analogy. No scan, schedule or alarm changed. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed, and why
Two leftovers from #1501 and #1502.
GET /tasks/tagsindocs/openapi.yamlstill described a global catalogue. Since #1501 the endpoint requiresview_tasksand is scoped by the same own-rows rule asGET /tasks(#1082): a non-admin user or scoped API key gets only the tags on tasks it created, with counts over those tasks, while the admin key,PermissionAdmincarriers andview_all_logsholders get the fleet-wide catalogue. The summary now says so in the same words the/tasksentry uses, so an API consumer does not mistake an omitted tag for a nonexistent one.The govulncheck cron category is correct and now says why. #1502 moved the weekly Grype upload onto the PR gate's category because GitHub expected the cron-only
grype-scheduledconfiguration on every PR.govulncheck-scheduled.ymllooks like the same shape, but is not: the per-PR govulncheck step inci.ymlruns the scan and uploads no SARIF, so this lane is the only govulncheck upload, there is no PR-side category to share, and GitHub shows no missing-configuration check for it (confirmed on #1501 and #1502, where only the Grype phantom appeared). The workflow comment anddocs/TESTING.mdrecord that so the category is not renamed by analogy. No scan command, schedule or alarm changed.How you verified it
make lintincluding actionlint over the edited workflow: clean.go test -tags fleet_host_executor -count=1 ./scripts/: PASS.gh pr checkson Board tags and tag filter, seven catalog corrections, and the #1006 OAuth pack record (supersedes #1495, #1496, #1499) #1501 and Upload the weekly Grype scan under the PR gate's SARIF category #1502: no "govulncheck" configuration-not-found check, only the Grype one that Upload the weekly Grype scan under the PR gate's SARIF category #1502 removed.Scope and deviations
Docs and one workflow comment only; no runtime, gate or schedule change. The alternative of making the PR gate emit SARIF under a shared category was not taken: it would change the per-PR gate for no visible defect.
docs/<FEATURE>.md) added, if this ships a feature — not a featuredocs/adr/, if this adds, weakens or reverses an invariant — none touched🤖 Generated with Claude Code