fix: only skip CVE remediation for open PRs - #1606
Conversation
Sorry, something went wrong.
|
@brendan-kellam your pull request is missing a changelog! |
Sorry, something went wrong.
|
Caution Review failedThe pull request is closed. Configuration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 95910976-d023-409f-acac-019c236da2f0 📥 CommitsReviewing files that changed from the base of the PR and between 3ce4393 and 8b240a4. 📒 Files selected for processing (5)
WalkthroughThe CVE remediation workflow now queries linked GitHub pull-request states, enriches issue attachments with those states, and excludes only issues linked to open pull requests. Tests cover closed pull requests and companion repositories. ChangesCVE open pull-request filtering
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CVEWorkflow
participant DiscoveryScript
participant GitHubAPI
participant JQFilter
CVEWorkflow->>DiscoveryScript: Pass GH_TOKEN and CVE issues
DiscoveryScript->>GitHubAPI: Query each unique pull-request endpoint
GitHubAPI-->>DiscoveryScript: Return open or closed state
DiscoveryScript->>JQFilter: Pass enriched issue attachments
JQFilter-->>CVEWorkflow: Return issues without open linked PRs
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands. |
Sorry, something went wrong.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8b240a4. Configure here.
Sorry, something went wrong.
| pull_number="${BASH_REMATCH[3]}" | ||
| if ! pr_state=$(gh api "repos/$owner/$repository/pulls/$pull_number" --jq '.state'); then | ||
| echo "Could not fetch linked GitHub pull request: $pr_url" >&2 | ||
| exit 1 |
There was a problem hiding this comment.
PR fetch failure aborts all discovery
Medium Severity
Any failed gh api lookup (or unparsable linked PR URL) exits the whole discovery script before filtering. One deleted, private companion, or temporarily unreachable attachment then blocks remediation for every CVE that night, including issues with no linked PRs. That conflicts with only suppressing issues that still have an open PR.
Additional Locations (1)Reviewed by Cursor Bugbot for commit 8b240a4. Configure here.
Sorry, something went wrong.
Summary
Test plan
No changelog entry per request.
Note
Medium Risk
Changes which CVEs enter automated remediation and adds GitHub API calls in discovery; misclassification could duplicate or miss remediation PRs.
Overview
CVE discovery no longer treats any linked PR as “in progress.” Issues are excluded from nightly remediation only when a Linear attachment points at a GitHub pull request that is still open; CVEs linked only to closed PRs (or with no PR) stay eligible for a new remediation run.
The discovery script now resolves each unique linked PR URL via gh api (using GH_TOKEN) and attaches githubPrState before the jq filter runs. The reusable workflow’s discover job adds pull-requests: read and passes the workflow token into the script.
Tests and workflow copy were updated for open vs closed attachments and to assert GitHub state lookups and permissions.
Reviewed by Cursor Bugbot for commit 8b240a4. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
New Features
Bug Fixes
Tests