74 lines
3.3 KiB
Markdown
74 lines
3.3 KiB
Markdown
# PR#63: Du bist dran Shows a Vulnerability Found on Main
|
|
|
|
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
|
|
|
|
## Related Links
|
|
|
|
- [PR#61](https://git.javagil.de/mi/werkregie/pulls/61), which brought Werkator's nightly build `vulnerability-data`.
|
|
- [PR#62](https://git.javagil.de/mi/werkregie/pulls/62), after which a vulnerability on main fails no pull request.
|
|
|
|
## Problem
|
|
|
|
Each night, Werkator's build `vulnerability-data` checks main for known vulnerabilities of its dependencies.
|
|
When it finds one, the build turns red, but nobody is told:
|
|
werkregie lists the build among many others, and since PR#62 no pull request fails on it.
|
|
The shared workflow requires such a vulnerability to be fixed at once, in a pull request of its own.
|
|
|
|
## Non-Goals
|
|
|
|
- No vulnerability of a pull request's own; its check `werkator/dependencies` shows it.
|
|
- No notification outside werkregie, e.g. by Matrix.
|
|
|
|
## Specification
|
|
|
|
### Feature: Du bist dran shows a vulnerability found on main
|
|
|
|
#### Scenario#63.01: a vulnerability on main is due
|
|
|
|
… so that the user fixes it at once.
|
|
|
|
- **Given** a repository whose latest nightly check of main found CVE-2015-6420 in `commons-collections` 3.2.1
|
|
- **When** the user opens werkregie
|
|
- **Then** "Du bist dran" lists it first, under "Absichern", with the vulnerability, the dependency and the repository
|
|
|
|
##### Verified by
|
|
|
|
- [WerkatorSourceTest "a failed vulnerability check of main names its vulnerabilities"](../../dashboard/src/test/kotlin/de/hoennig/werkregie/dashboard/sources/WerkatorSourceTest.kt)
|
|
|
|
#### Scenario#63.02: a fixed vulnerability is no longer due
|
|
|
|
… so that "Du bist dran" lists only what is still open.
|
|
|
|
- **Given** a failed nightly check of main, and a newer green one
|
|
- **When** the user opens werkregie
|
|
- **Then** "Du bist dran" lists no vulnerability of that repository
|
|
|
|
##### Verified by
|
|
|
|
- [WerkatorSourceTest "a failed vulnerability check of main names its vulnerabilities"](../../dashboard/src/test/kotlin/de/hoennig/werkregie/dashboard/sources/WerkatorSourceTest.kt)
|
|
|
|
#### Scenario#63.03: a check without report is due too
|
|
|
|
… so that a broken check does not hide the vulnerabilities.
|
|
|
|
- **Given** a failed nightly check of main without a report, e.g. after a failed download of the NVD data
|
|
- **When** the user opens werkregie
|
|
- **Then** "Du bist dran" lists the check as failed without a report
|
|
|
|
##### Verified by
|
|
|
|
- [WerkatorSourceTest "a failed vulnerability check without report is due as well"](../../dashboard/src/test/kotlin/de/hoennig/werkregie/dashboard/sources/WerkatorSourceTest.kt)
|
|
|
|
## Solution
|
|
|
|
- `WerkatorSource` marks the newest build of a repository's main named `vulnerability-data`, when it failed,
|
|
with the marker `vulnerable`; a newer green build of the same name supersedes it.
|
|
- It reads the vulnerabilities from OWASP Dependency-Check's JSON report in the build's artifacts,
|
|
under `reports/dependency-check/` or `dashboard/build/reports/dependency-check/`, once per build.
|
|
- The page lists such a build first in "Du bist dran", in the group "Absichern", and links it to its build in Werkator.
|
|
- `doc/agentic-workflow.md`, the master copy: the nightly check of main is named `vulnerability-data`,
|
|
so that werkregie shows its findings.
|
|
- Version 0.40.0.
|