werkregie checks its dependencies for vulnerabilities and licenses #59
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mi/werkregie#59
Reference in New Issue
Block a user
See the PR document.
🤖 Generated with Claude Code
f49c3891f9to447a95be35🟡 werkrevisor YELLOW for
447a95b, superseded by the result for3bba749🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Findings
dashboard/build.gradle.kts:145-146, severity unknown, counted as medium, hint, as a line commentClassifier
7 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 14305, calls 1, tokens in 13809 / out 12211 (reasoning included in out), duration 104.8 s, cost 0.0188 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6296, cost 0.0003 USD, finding judge `jev-1.13.0` calls 1, tokens in 2313, cost 0.0001 USD, build file judge `jev-1.13.0` calls 4, tokens in 4864, cost 0.0002 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 1.3 s, model_review 101.5 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main1 answer ignored because of a confidence below [classifier] min_confidence.
470d826).Reviewed head `447a95be35e2c94a209b2ca83b61b0c306cb1dcb` against base `470d826c1033c0b21bf8b4ed9e809d3850247acd`, werkrevisor 0.41.0.
werkrevisor: YELLOW / HUMAN_REVIEW for
447a95be35e2c94a209b2ca83b61b0c306cb1dcb.The result comment of werkrevisor holds the details.
@@ -105,0 +142,4 @@allowedLicensesFile = file("config/allowed-licenses.json")}// dependencyCheckAnalyze runs as Werkator's build "dependencies": the first download of the NVD data exceeds the build's timeoutMisleading comment with redundant wiring, severity unknown, counted as medium (werkrevisor)
hint; Jev: real 0.58, severity 1.0 of 3
Line 146's
tasks.check { dependsOn("checkLicense") }is redundant: thecom.github.jk1.dependency-license-reportplugin (3.1.4) already wirescheckLicenseintocheck. The comment on line 145 explains whydependencyCheckAnalyzeis intentionally NOT part ofcheck(the NVD download would exceed the build timeout), so placing it right above acheckLicenseline is confusing — a reader expects the comment to document the line below it. Either drop the redundantcheckLicenseline or move the comment so the two are not adjacent.Partly fixed in
b85d5a9: the comment about OWASP Dependency-Check moved to its block, and checkLicense got its own comment.The line itself stays: without it,
./gradlew check --dry-runlists no checkLicense, so plugin 3.1.4 does not add it to check.@@ -0,0 +54,4 @@## Deviations from the Defaults of the Required Checks- None. The mutation tests are still missing; they follow as a nightly build.Writing rule: more than one sentence on a line (werkrevisor writing rule)
Fix the line, or reply why it stays, and resolve this comment.
Fixed in
b85d5a9: one sentence per line.b85d5a97b8to3bba749daf🟡 werkrevisor YELLOW for
3bba749, superseded by the result forb92abeb🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Findings
Unclear follow-up wording at
doc/prs/2026-10-13-PR#59-dependency-checks.md:83-84, severity unknown, counted as mediumhint; Jev: real 0.56, severity 1.4 of 3
The Follow-up PRs section is terse and unexplained: "The build
dependenciesfor each PR branch, once main knows its status context; the human then addswerkator/dependenciesto the required checks ofmain." A reader unfamiliar with Werkator's status-context mechanism cannot tell why a successful main build is required before the human can add the context as a required check on PR branches, nor why the new build is restricted tobranches: ["main"]for now. The accompanying .werkator.yml comment ("PR builds follow once main knows it") is equally terse; spelling out the rationale would make the follow-up actionable.Classifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 14301, calls 1, tokens in 13807 / out 13854 (reasoning included in out), duration 121.8 s, cost 0.0207 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6257, cost 0.0003 USD, finding judge `jev-1.13.0` calls 1, tokens in 1946, cost 0.0001 USD, build file judge `jev-1.13.0` calls 4, tokens in 4886, cost 0.0002 USD, phases: path_judge 0.3 s, classifier 0.7 s, context 2.8 s, model_review 117.1 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main1 answer ignored because of a confidence below [classifier] min_confidence.
bcf45a9).Reviewed head `3bba749dafdfc728603aa399513c500d47afa533` against base `bcf45a996494d09be706fc7ec859bd3e824d77f1`, werkrevisor 0.41.0.
🟠 werkrevisor ORANGE for
b92abeb, superseded by the result for7c9544b🟠 werkrevisor: ORANGE / FINDINGS
Change kind:
mixed.Reasons
Findings
Reports not archived at
.werkator.yml:38-44, severity unknown, counted as medium, ORANGE, as a line commentEmpty timeout convention at
.werkator.yml:33-44, severity unknown, counted as medium, YELLOW, as a line commentMisleading "nightly build" comment at
dashboard/build.gradle.kts:128, severity unknown, counted as medium, hint, as a line commentClassifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 14285, calls 1, tokens in 13794 / out 21398 (reasoning included in out), duration 240.3 s, cost 0.0298 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6334, cost 0.0003 USD, finding judge `jev-1.13.0` calls 3, tokens in 5877, cost 0.0002 USD, build file judge `jev-1.13.0` calls 4, tokens in 4903, cost 0.0002 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 0.9 s, model_review 237.6 s, finding_judge 0.2 s, config: defaults + host + repository (.werkrevisor.toml at mainbcf45a9).Reviewed head `b92abeb06c6db22c661aa17e28804e009626cbb1` against base `bcf45a996494d09be706fc7ec859bd3e824d77f1`, werkrevisor 0.41.0.
werkrevisor: ORANGE / FINDINGS for
b92abeb06c6db22c661aa17e28804e009626cbb1.The result comment of werkrevisor holds the details.
@@ -30,2 +30,4 @@stdoutLog: build.stdout.logstderrLog: build.stderr.log# The known vulnerabilities of the dependencies (doc/risk-analysis.md). The first download of the NVD data takesEmpty timeout convention, severity unknown, counted as medium (werkrevisor)
YELLOW; Jev: real 0.47, severity 2.8 of 3
The Werkator
dependenciesbuild usestimeout: "", which the inline comment and the PR doc claim means "host's longest timeout" / "no timeout". This is a Werkator-specific value and not a standard YAML duration; without confirming Werkator's parser, an unexpected default could be applied. If Werkator treats the empty value as a short default, the first download (the comment says it exceeds the default build's 10 minutes) will time out, defeating the reason this build is split off.No change of the value: Werkator's docs/configuration.md, builds.default.timeout, says "Empty takes the host's executor.buildTimeout; a longer value is capped to it".
Without it, the build would inherit the 10 min of default; werkator's own build mutation uses timeout: "" the same way.
7c9544bnames it in a comment.@@ -32,0 +35,4 @@# NVD_API_KEY comes from the host's .git/werkator/.werkator.yml.# Only main for now: Werkator reads statusContext from main, so on a branch that alone defines this build# it would report as "werkator" and overwrite the status of default; PR branches follow once main has the context.dependencies:Reports not archived, severity unknown, counted as medium (werkrevisor)
ORANGE; Jev: real 0.88, severity 2.6 of 3
The
dependenciesbuild declares noartifactDirs, so the OWASP Dependency-Check reports produced atdashboard/build/reports/dependency-check/(HTML and JSON, configured independencyCheck { formats = listOf("HTML", "JSON") }) are not archived as build artifacts. On a failed run the report is lost with the runner, making triage of the named vulnerability harder than for the default build, which does archivedashboard/build/reports.The reports are archived: a named build inherits everything from builds.default but its trigger (Werkator's docs/configuration.md: "the only part a definition does NOT inherit"), so artifactDirs [dashboard/build/reports] applies, and the dependency-check report lies in dashboard/build/reports/dependency-check.
7c9544bnames it in a comment.@@ -105,0 +125,4 @@// an empty key, e.g. a variable set to "", counts as none: the NVD refuses a key of length 0apiKey = providers.environmentVariable("NVD_API_KEY").orElse(providers.gradleProperty("OWASP_API_KEY")).orNull?.takeIf { it.isNotBlank() }// the nightly build "dependencies" of .werkator.yml updates the data in the shared Gradle homeMisleading "nightly build" comment, severity unknown, counted as medium (werkrevisor)
hint; Jev: real 0.68, severity 1.2 of 3
The comment "the nightly build 'dependencies' of .werkator.yml updates the data in the shared Gradle home" sits next to
validForHours = 24, but.werkator.ymltriggers thedependenciesbuild withonPush: true, branches: ["main"], i.e. on every push, not on a nightly schedule. The wording misleads future readers about when the NVD cache is refreshed and is inconsistent with the trigger in the same PR.Fixed in
7c9544b: the comment names the build on each push to main and the update at most once a day.🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Classifier
8 of 8 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 14423, calls 1, tokens in 13926 / out 15537 (reasoning included in out), duration 154.4 s, cost 0.0228 USD (reported), classifier `jev-1.13.0` calls 8, tokens in 6334, cost 0.0003 USD, build file judge `jev-1.13.0` calls 4, tokens in 4968, cost 0.0002 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 1.7 s, model_review 150.4 s, config: defaults + host + repository (.werkrevisor.toml at mainbcf45a9).Reviewed head `7c9544bca16445994f88091f15dce3161d80f617` against base `bcf45a996494d09be706fc7ec859bd3e824d77f1`, werkrevisor 0.41.0.