werkregie/doc/prs/2026-10-13-PR#61-dependencies-for-prs.md

PR#61: Each Pull Request Is Checked for Vulnerable Dependencies

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Related Links

• PR#59, which brought OWASP Dependency-Check, for main only.

Problem

Since PR#59, Werkator's build dependencies checks main for known vulnerabilities. A pull request is not checked, so a vulnerable dependency shows only after its merge. The check also loads the NVD data itself, at most once a day: the first build of a day waits for the update, which takes minutes.

Non-Goals

• No required check of main in Gitea's branch protection; the human sets it.
• No mutation tests.

Specification

Feature: each pull request is checked for vulnerable dependencies

Scenario#61.01: a pull request with a vulnerable dependency shows a red check

… so that a vulnerable dependency does not reach main.

• Given a pull request that adds a dependency with a known vulnerability of CVSS 4 or more
• When Werkator builds the pull request
• Then its check werkator/dependencies is red and names the vulnerability

Verified by

• Werkator's build dependencies of this pull request, green, under werkator/dependencies.

Scenario#61.02: the check does not wait for the vulnerability data

… so that a pull request is checked in seconds, also the first one of a day.

• Given the vulnerability data of the night before
• When Werkator builds a pull request
• Then the check reads the data without updating it

Verified by

• Werkator's build dependencies of this pull request: no update in its log.

Solution

• .werkator.yml:
  • the build dependencies runs for each branch, no longer for main only; since PR#59, main sets its status context werkator/dependencies, so a branch no longer overwrites werkator;
  • its trigger names branches: ["*"]: Werkator merges a branch's trigger key by key into main's, so a trigger without branches kept main's ["main"], and the first push of this PR ran no check;
  • a new build vulnerability-data runs dependencyCheckUpdate each night at 02:00 UTC on main, under werkator/vulnerability-data, with the host's longest timeout.
• dashboard/build.gradle.kts: autoUpdate = false, so dependencyCheckAnalyze only reads the data. Werkator's direct builds share the Gradle home of the user mih09-werkator, which holds the data.
• AGENTS.md: locally, ./gradlew dependencyCheckUpdate loads the data before the first check.
• Version 0.38.1.

Open Questions

• When does the slow update of the vulnerability data run? At night, in a build of its own, chosen by the human; every check only reads the data.