Repository navigation
ci: resolve Scorecard code scanning alerts - #641
Open
rhuanbarreto wants to merge 1 commit into
Open
rhuanbarreto wants to merge 1 commit into
rhuanbarreto wants to merge 1 commit into
Conversation
Bump ossf/scorecard-action to v2.5.0 (Scorecard v5.6.0), which treats $/ self-repository action references as local, resolving the Pinned-Dependencies false positives (alerts 67-74). Add osv-scanner.toml ignoring GHSA-vfj7-8cjw-p6xm (alert 66): braces has no patched release and is reached only through the dev-only @simple-release/npm release tooling with repository-authored globs. osv-scanner.toml joins the GEN-005 root allowlist as tool configuration required at the root by convention. Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 58 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying archgate-cli with
|
| Latest commit: |
a1db725
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://fe2b0627.archgate-cli.pages.dev |
| Branch Preview URL: | https://fix-code-scanning-alerts.archgate-cli.pages.dev |
Contributor
Code Coverage
Full HTML report available in workflow artifacts. Per-directory breakdown
|
rhuanbarreto
added a commit
that referenced
this pull request
Oct 24, 2026
#647) ## Problem and behavior Windows binary upgrades can report Sentry CLI-D when `powershell` is absent from PATH. ZIP extraction resolves Windows PowerShell on PATH, then `%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe` (falling back to `C:\Windows` for unusable SystemRoot). Missing PowerShell raises an actionable `UserError` before spawn. ZIP packaging, checksum verification, archive validation, replacement, cleanup, and unrelated internal-error handling are preserved. PowerShell Core support remains outside this change. CLI-C is verification only: deleted-cwd review-context exits 1 with an actionable message and no Sentry capture; an unrelated TypeError exits 2 and is captured. The production fix from #621 is already on main and was first published in v0.58.1. Sentry references (unchanged): https://archgate.sentry.io/issues/155567289/ and https://archgate.sentry.io/issues/150086449/. ## Scope Two commits, three files: `src/helpers/binary-upgrade.ts`, `tests/helpers/binary-upgrade-archive.test.ts`, and `tests/commands/review-context-cwd.test.ts`. No #631 Store/distribution work or #641 overlap. Base: `fd92933ccad95468772b1aec18cda0f959394450`. Head: `f44a5f2f92c58921f8a33af6b8f0ef263e0c8ba9`, with first commit `edc0cbc73a88c28fae6fdfdaeaaeb9494e8e11cf`. Tree: `55b2060a97c8dbc84d9f1404e7f75a8cc78c546d`, identical to independently reviewed head `327b2145118905e62e11efeb564fc42e3c7c0a61`. ## Actual full CI Marked ready for review to invoke the workflow's supported `ready_for_review` event. Draft conditions previously skipped validation/smoke jobs, causing the aggregate to fail. No workflow rules, required checks, test gates, or skips were changed. [Full Validate run on the unchanged tree at f44a5f2](https://github.com/archgate/cli/actions/runs/40098167162) **PASSED**, including: - Linux full `validate:coverage`: 2,963 passed, 22 existing skips, zero failures; lint, typecheck, formatting, ADR checks (22 passed), Knip, compilation, dependency audit, and generated-doc verification passed. - Windows full coverage suite: 2,961 passed, 22 existing skips, zero failures; lint/typecheck/formatting, compiled binary and installer smoke job passed. - Linux smoke, workflow security/schema, ADR SARIF, merged coverage threshold, and aggregate Validate Code passed. Shim tests used the workflow's existing conditional skip because no shim files changed. - Required DCO is blocked: both original commits lack Signed-off-by trailers. A worker briefly added matching-author trailers, then removed them after confirming that matching global Git configuration does not establish authority to certify for that contributor. Contributor certification under DCO 1.1 is required before sign-off can be added. No DCO bypass or policy change is proposed. Latest results are available in [PR checks](https://github.com/archgate/cli/pull/647/checks). ## Additional verification and limitations Test-first CLI-D regressions failed against the unchanged extractor and passed with the fix. Scoped suite: 104 passed, three platform skips, zero failures. Coverage includes PATH precedence, custom/unset/empty/literal-undefined SystemRoot, missing shell, extraction cleanup, and preservation of unrelated spawn errors. A real Windows ZIP probe with PowerShell excluded from PATH verified SHA256 and extracted payload. Independent ADR review found no code issues. Prior local full `bun run validate` runs FAILED and are not represented as passing. The bounded Windows comparison had patch 2,921 passed / 39 skipped / 23 failed, versus clean main 2,911 / 39 / 24. All 23 patch failure names also appeared on baseline: 18 Antigravity reader cases, one credential-helper case, and four startup budgets. Both standalone startup runs passed six tests, but differing host load leaves timing attribution inconclusive. CI's fresh full Linux and Windows coverage runs above passed without changing those unrelated suites or weakening gates. Ready for review; no approval or merge performed. Sentry issues remain unchanged. --------- Signed-off-by: Rhuan Barreto <rhuan@barreto.work>
Merged
rhuanbarreto
pushed a commit
that referenced
this pull request
Oct 28, 2026
# archgate ## [0.61.0](v0.60.2...v0.61.0) (2026-10-28) ### Features * publish Intel macOS (darwin-x64) binaries ([#658](#658)) ([3b9d851](3b9d851)) ### Bug Fixes * **upgrade:** discover installed Windows PowerShell for ZIP extraction ([#647](#647)) ([f90760c](f90760c)), closes [#621](#621), references [#631](#631) [#641](#641) --- This PR was generated with [simple-release](https://github.com/TrigenSoftware/simple-release). <details> <summary>📄 Cheatsheet</summary> <br> You can configure the bot's behavior through a pull request comment using the `!simple-release/set-options` command. ### Command Format ````md !simple-release/set-options ```json { "bump": {} } ``` ```` ### Useful Parameters The options shape the pull request generation, so the `bump` ones matter here. Release-time options like `publish` belong in the config file. | Parameter | Type | Description | |-----------|------|-------------| | `version` | `string` | Force set specific version | | `as` | `'major' \| 'minor' \| 'patch' \| 'prerelease'` | Release type. `prerelease` keeps the type derived from the commits and makes the version a prerelease | | `prerelease` | `string` | Pre-release identifier (e.g., "alpha", "beta") | | `firstRelease` | `boolean` | Whether this is the first release | | `skip` | `boolean` | Skip version bump | | `byProject` | `Record<string, object>` | Per-project bump options for monorepos | ### Usage Examples #### Force specific version ````md !simple-release/set-options ```json { "bump": { "version": "2.0.0" } } ``` ```` #### Force major bump ````md !simple-release/set-options ```json { "bump": { "as": "major" } } ``` ```` #### Create alpha pre-release ````md !simple-release/set-options ```json { "bump": { "prerelease": "alpha" } } ``` ```` ### Custom Changelog Preamble You can add custom markdown to the top of the changelog (right after the version header) using the `!simple-release/set-preamble` command. The markdown after the command line becomes the preamble. Start its headings at `###` — the level of the generated changelog sections like `### Features`. ```md !simple-release/set-preamble ### What's new? - The website was completely redesigned - The new API gives you awesome possibilities ``` In a monorepo, pass the full package name after the command to target a single package's changelog. Wrap the name in backticks so GitHub keeps it as text instead of a mention: ```md !simple-release/set-preamble `@your-org/core` ### Core changes - New plugin system ``` Use one comment per package, plus one without a name for the whole release. ### Access Restrictions The commands can only be used by users with permissions: - repository owner - organization member - collaborator ### Notes - The last comment with `!simple-release/set-options` command takes priority - The last `!simple-release/set-preamble` comment per package takes priority - JSON must be valid, otherwise the `set-options` command will be ignored - Parameters apply only to the current release execution - The commands can be updated by editing the comment or adding a new one </details> <!-- Please do not edit this comment. simple-release-pull-request: true simple-release-branch-from: release simple-release-branch-to: main --> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all 9 open code scanning alerts.
Pinned-Dependencies (alerts 67–74) — false positives: Scorecard v5.4 misreads the
$/self-repository syntax adopted in #627 as unpinned third-party actions. Scorecard v5.6.0 (release notes, ossf/scorecard#5191) treats$/like./. Bumpedossf/scorecard-actionto v2.5.0, pinned by hash per CI-001.Vulnerabilities (alert 66) — GHSA-vfj7-8cjw-p6xm, braces ≤3.0.3 stack exhaustion. No patched braces/micromatch/fast-glob/@simple-release release exists. Path is dev-only:
@simple-release/npm→ fast-glob → micromatch → braces, expanding repository-authored globs only; nothing ships in the CLI binary. Addedosv-scanner.toml(the ignore mechanism Scorecard documents) with a reason andignoreUntil = 2027-01-31so it gets re-evaluated.GEN-005:
osv-scanner.tomladded to the root allowlist — criterion: tool configuration required at the root by convention (Scorecard reads it next to the manifest).Validation:
bun run validatepasses.