69 lines
2.9 KiB
Markdown
69 lines
2.9 KiB
Markdown
# PR#61: Each Pull Request Is Checked for Vulnerable Dependencies
|
|
|
|
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
|
|
|
|
## Related Links
|
|
|
|
- [PR#59](https://git.javagil.de/mi/werkregie/pulls/59), which brought OWASP Dependency-Check, for main only.
|
|
|
|
## Problem
|
|
|
|
Since PR#59, Werkator's build `dependencies` checks main for known vulnerabilities.
|
|
A pull request is not checked, so a vulnerable dependency shows only after its merge.
|
|
The check also loads the NVD data itself, at most once a day:
|
|
the first build of a day waits for the update, which takes minutes.
|
|
|
|
## Non-Goals
|
|
|
|
- No required check of `main` in Gitea's branch protection; the human sets it.
|
|
- No mutation tests.
|
|
|
|
## Specification
|
|
|
|
### Feature: each pull request is checked for vulnerable dependencies
|
|
|
|
#### Scenario#61.01: a pull request with a vulnerable dependency shows a red check
|
|
|
|
… so that a vulnerable dependency does not reach main.
|
|
|
|
- **Given** a pull request that adds a dependency with a known vulnerability of CVSS 4 or more
|
|
- **When** Werkator builds the pull request
|
|
- **Then** its check `werkator/dependencies` is red and names the vulnerability
|
|
|
|
##### Verified by
|
|
|
|
- Werkator's build `dependencies` of this pull request, green, under `werkator/dependencies`.
|
|
|
|
#### Scenario#61.02: the check does not wait for the vulnerability data
|
|
|
|
… so that a pull request is checked in seconds, also the first one of a day.
|
|
|
|
- **Given** the vulnerability data of the night before
|
|
- **When** Werkator builds a pull request
|
|
- **Then** the check reads the data without updating it
|
|
|
|
##### Verified by
|
|
|
|
- Werkator's build `dependencies` of this pull request: no update in its log.
|
|
|
|
## Solution
|
|
|
|
- `.werkator.yml`:
|
|
- the build `dependencies` runs for each branch, no longer for main only;
|
|
since PR#59, main sets its status context `werkator/dependencies`, so a branch no longer overwrites `werkator`;
|
|
- its trigger names `branches: ["*"]`: Werkator merges a branch's trigger key by key into main's,
|
|
so a trigger without `branches` kept main's `["main"]`, and the first push of this PR ran no check;
|
|
- a new build `vulnerability-data` runs `dependencyCheckUpdate` each night at 02:00 UTC on main,
|
|
under `werkator/vulnerability-data`, with the host's longest timeout.
|
|
- `dashboard/build.gradle.kts`: `autoUpdate = false`, so `dependencyCheckAnalyze` only reads the data.
|
|
Werkator's direct builds share the Gradle home of the user `mih09-werkator`, which holds the data.
|
|
- `AGENTS.md`: locally, `./gradlew dependencyCheckUpdate` loads the data before the first check.
|
|
- Version 0.38.1.
|
|
|
|
## Open Questions
|
|
|
|
- [x] When does the slow update of the vulnerability data run?
|
|
At night, in a build of its own, chosen by the human; every check only reads the data.
|