Repository navigation
ci: Hash-pin PyYAML and apply osv-scanner suppressions to govulncheck SARIF - #1341
Merged
Merged
Conversation
… SARIF Clears code-scanning alerts 205 and 247. Alert 205 (Scorecard Pinned-Dependencies): issue-templates-drift.yml ran a bare `pip install pyyaml`. It now installs from .github/requirements/issue-templates-drift.txt, which pins pyyaml==6.0.3 to its published sha256 hashes, with `pip install --require-hashes --no-deps`. A Dependabot pip entry for /.github/requirements keeps it current, with the same cooldown as the other ecosystems, and the requirements file joins the workflow's path triggers. Alert 247 (govulncheck GO-2026-5932): the advisory marks golang.org/x/crypto/openpgp unmaintained and has no fixed version, so no x/crypto bump can clear it. GLX does not import the package; osv-scanner.toml already suppresses it for osv-scanner and Scorecard (#1262), but govulncheck has no ignore mechanism and its SARIF still carried it as a module-level note. scripts/filter-govulncheck-sarif.py now drops a SARIF result only when its ID is in osv-scanner.toml AND its level is "note", so one reviewed list governs both scanners, and a suppressed advisory that becomes imported or called is reported again. SECURITY-POSTURE.md documents the filter. Also adds the OpenSSF Best Practices badge (project 15136) to the README, toward alert 59, and removes a truncated duplicate of the #1262 CHANGELOG entry. Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com>
Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com>
Deploying genealogix with
|
| Latest commit: |
f0f8d78
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://ebea976b.genealogix.pages.dev |
| Branch Preview URL: | https://fix-code-scanning-205-247.genealogix.pages.dev |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
3 tasks
Signed-off-by: Noah B Johnson <noah@noahbjohnson.net>
noahbjohnson
enabled auto-merge (squash)
October 4, 2026 07:13
noahbjohnson
approved these changes
Oct 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Clears two open code-scanning alerts and takes the first code step on a third.
Alert 205: Scorecard Pinned-Dependencies,
pipCommand not pinned by hashissue-templates-drift.ymlran a barepip install pyyaml, the only unpinnedpip installin any workflow (checked with a grep over.github/workflows/;scripts/generate-social-preview.pymentions one only in a docstring, which Scorecard does not scan)..github/requirements/issue-templates-drift.txtpinspyyaml==6.0.3with all 73 published sha256 hashes (the formpip-compile --generate-hashesemits).pip install --require-hashes --no-deps -r .github/requirements/issue-templates-drift.txt.--no-depsis safe because PyYAML has no dependencies..github/dependabot.ymlgains apipecosystem for/.github/requirements, with the same cooldown tiers asgomod/npm, so the version and hashes are kept current rather than frozen.paths:triggers, so a Dependabot bump re-runs the check.Alert 247: govulncheck
GO-2026-5932GO-2026-5932marksgolang.org/x/crypto/openpgpunmaintained. It has no fixed version (introduced: 0, nofixedevent in the OSV record), so bumpingx/cryptocannot clear it;v0.57.0is still affected. #1262 already suppressed it for osv-scanner and Scorecard inosv-scanner.toml, with the reasoning (GLX never importsx/crypto/openpgp). govulncheck has no ignore mechanism, though, and its SARIF still carries the advisory as a module-levelnote, which is what raised alert 247.scripts/filter-govulncheck-sarif.pyruns between govulncheck and the SARIF upload insecurity.yml. It drops a result only when its ID is listed inosv-scanner.tomland its level isnote(module required, package not imported). A suppressed advisory that later shows up atwarning(imported) orerror(called) is kept, because that is the case where the recorded reasoning has stopped holding.osv-scanner.tomlstays the single reviewed suppression list for both scanners; nothing new is suppressed.SECURITY-POSTURE.md, Vulnerability suppression, documents the filter.Alert 59: Scorecard CII-Best-Practices
Not clearable from code: it scores the bestpractices.dev questionnaire. The project is now registered as 15136, and this PR adds its badge to the README beside the Scorecard badge. Scorecard credits in-progress at 2/10 and passing at 5/10. The questionnaire work is tracked in #1023.
Also
Removes a truncated duplicate of the #1262 CHANGELOG entry (the same text, missing its continuation paragraphs and PR reference) that sat a few lines above the full one under Fixed.
Related issues
Alerts 205, 247 and 59 above. Badge questionnaire: #1023, which stays open until the badge is earned.
Review focus
note-only rule inscripts/filter-govulncheck-sarif.py: it should never hide a reachable finding..github/requirements/is the right home for workflow-only Python pins.Testing
govulncheck -format sarif ./...locally: one result,GO-2026-5932at levelnote. Through the filter: zero results. The same SARIF with the level rewritten towarning: the result is kept, with a warning on stderr.pip install --require-hashes --no-deps -r .github/requirements/issue-templates-drift.txtinto a clean venv: installs PyYAML 6.0.3.go build ./...,go test ./...,make check-links,make check-memory-drift,markdownlint-cli2on the changed Markdown: all clean.mainonly, because the Scorecard workflow has nopull_requesttrigger.Breaking changes
None. CI-only; no GLX code changed.