# PR#63: Du bist dran Shows a Vulnerability Found on Main

> **WARNING:** This document describes only the change applied in this PR.
> It may already be outdated once the next PR is merged.
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

## Related Links

- [PR#61](https://git.javagil.de/mi/werkregie/pulls/61), which brought Werkator's nightly build `vulnerability-data`.
- [PR#62](https://git.javagil.de/mi/werkregie/pulls/62), after which a vulnerability on main fails no pull request.

## Problem

Each night, Werkator's build `vulnerability-data` checks main for known vulnerabilities of its dependencies.
When it finds one, the build turns red, but nobody is told:
werkregie lists the build among many others, and since PR#62 no pull request fails on it.
The shared workflow requires such a vulnerability to be fixed at once, in a pull request of its own.

## Non-Goals

- No vulnerability of a pull request's own; its check `werkator/dependencies` shows it.
- No notification outside werkregie, e.g. by Matrix.

## Specification

### Feature: Du bist dran shows a vulnerability found on main

#### Scenario#63.01: a vulnerability on main is due

… so that the user fixes it at once.

- **Given** a repository whose latest nightly check of main found CVE-2015-6420 in `commons-collections` 3.2.1
- **When** the user opens werkregie
- **Then** "Du bist dran" lists it first, under "Absichern", with the vulnerability, the dependency and the repository

##### Verified by

- [WerkatorSourceTest "a failed vulnerability check of main names its vulnerabilities"](../../dashboard/src/test/kotlin/de/hoennig/werkregie/dashboard/sources/WerkatorSourceTest.kt)

#### Scenario#63.02: a fixed vulnerability is no longer due

… so that "Du bist dran" lists only what is still open.

- **Given** a failed nightly check of main, and a newer green one
- **When** the user opens werkregie
- **Then** "Du bist dran" lists no vulnerability of that repository

##### Verified by

- [WerkatorSourceTest "a failed vulnerability check of main names its vulnerabilities"](../../dashboard/src/test/kotlin/de/hoennig/werkregie/dashboard/sources/WerkatorSourceTest.kt)

#### Scenario#63.03: a check without report is due too

… so that a broken check does not hide the vulnerabilities.

- **Given** a failed nightly check of main without a report, e.g. after a failed download of the NVD data
- **When** the user opens werkregie
- **Then** "Du bist dran" lists the check as failed without a report

##### Verified by

- [WerkatorSourceTest "a failed vulnerability check without report is due as well"](../../dashboard/src/test/kotlin/de/hoennig/werkregie/dashboard/sources/WerkatorSourceTest.kt)

## Solution

- `WerkatorSource` marks the newest build of a repository's main named `vulnerability-data`, when it failed,
  with the marker `vulnerable`; a newer green build of the same name supersedes it.
- It reads the vulnerabilities from OWASP Dependency-Check's JSON report in the build's artifacts,
  under `reports/dependency-check/` or `dashboard/build/reports/dependency-check/`, once per build.
- The page lists such a build first in "Du bist dran", in the group "Absichern", and links it to its build in Werkator.
- `doc/agentic-workflow.md`, the master copy: the nightly check of main is named `vulnerability-data`,
  so that werkregie shows its findings.
- Version 0.40.0.