werkregie/doc/prs/2026-10-13-PR#63-vulnerability-notice.md

PR#63: Du bist dran Shows a Vulnerability Found on Main

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

Related Links

• PR#61, which brought Werkator's nightly build vulnerability-data.
• PR#62, after which a vulnerability on main fails no pull request.

Problem

Each night, Werkator's build vulnerability-data checks main for known vulnerabilities of its dependencies. When it finds one, the build turns red, but nobody is told: werkregie lists the build among many others, and since PR#62 no pull request fails on it. The shared workflow requires such a vulnerability to be fixed at once, in a pull request of its own.

Non-Goals

• No vulnerability of a pull request's own; its check werkator/dependencies shows it.
• No notification outside werkregie, e.g. by Matrix.

Specification

Feature: Du bist dran shows a vulnerability found on main

Scenario#63.01: a vulnerability on main is due

… so that the user fixes it at once.

• Given a repository whose latest nightly check of main found CVE-2015-6420 in commons-collections 3.2.1
• When the user opens werkregie
• Then "Du bist dran" lists it first, under "Absichern", with the vulnerability, the dependency and the repository

Verified by

• WerkatorSourceTest "a failed vulnerability check of main names its vulnerabilities"

Scenario#63.02: a fixed vulnerability is no longer due

… so that "Du bist dran" lists only what is still open.

• Given a failed nightly check of main, and a newer green one
• When the user opens werkregie
• Then "Du bist dran" lists no vulnerability of that repository

Verified by

• WerkatorSourceTest "a failed vulnerability check of main names its vulnerabilities"

Scenario#63.03: a check without report is due too

… so that a broken check does not hide the vulnerabilities.

• Given a failed nightly check of main without a report, e.g. after a failed download of the NVD data
• When the user opens werkregie
• Then "Du bist dran" lists the check as failed without a report

Verified by

• WerkatorSourceTest "a failed vulnerability check without report is due as well"

Solution

• WerkatorSource marks the newest build of a repository's main named vulnerability-data, when it failed, with the marker vulnerable; a newer green build of the same name supersedes it.
• It reads the vulnerabilities from OWASP Dependency-Check's JSON report in the build's artifacts, under reports/dependency-check/ or dashboard/build/reports/dependency-check/, once per build.
• The page lists such a build first in "Du bist dran", in the group "Absichern", and links it to its build in Werkator.
• doc/agentic-workflow.md, the master copy: the nightly check of main is named vulnerability-data, so that werkregie shows its findings.
• Version 0.40.0.