fix(ci): reconcile vulnerability findings with Linear#1505
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
WalkthroughVulnerability triage now requires complete scanner data, deterministically matches findings to Linear issues, and closes managed issues absent from the current findings. New jq filters and shell tests cover matching, deduplication, reopening, and classification behavior. ChangesVulnerability triage reconciliation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Scanner as Dependabot and CodeQL
participant Workflow as Vulnerability triage
participant Linear as Linear API
participant jq as jq filters
Scanner->>Workflow: Submit alert snapshot
Workflow->>Linear: Search managed issues
Linear-->>Workflow: Return issue candidates and states
Workflow->>jq: Match and classify findings
jq-->>Workflow: Return issue selections and close actions
Workflow->>Linear: Complete resolved issues
Possibly related PRs
Suggested reviewers: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 950c111. Configure here.
| always() && | ||
| !cancelled() && | ||
| needs.check-alerts.result == 'success' && | ||
| (needs.scan.result == 'success' || needs.scan.result == 'skipped') |
There was a problem hiding this comment.
Skipped Trivy closes issues
High Severity
Linear reconciliation runs when the Trivy job is skipped, builds findings without container scan data, and the auto-close step treats missing Trivy CVEs as resolved. Open Linear issues for container-only findings can be completed even though no Trivy snapshot was collected.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 950c111. Configure here.
| echo "::error::Failed to create $FAILED_COUNT Linear issue(s)" | ||
| exit 1 | ||
| fi | ||
|
|
There was a problem hiding this comment.
Create failure blocks issue closure
Medium Severity
The Create Linear issues step exits with failure when any create or reopen fails, so the new Close resolved Linear issues step never runs. Resolved findings can stay open in Linear because inbound sync aborted before outbound reconciliation.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 950c111. Configure here.
1 participant
Summary
Make vulnerability-to-Linear reconciliation exact, fail-closed, and bidirectional.
Matching and safety
Issues use the canonical title format
[repository] finding-id: titleand are queried within the Sourcebot team. Matching is exact, including repository and finding ID, so prefix collisions and CodeQL IDs containing colons do not produce false matches. Auto-close is limited to active, pipeline-managed issues from the current repository. Dry-run mode suppresses create, reopen, and close mutations.Tests
Adds a focused regression suite covering:
Also adds the focused suite to the pull-request test workflow.
Related: SOU-1587
Note
Medium Risk
Workflow now mutates Linear issue state and fails hard on API gaps; incorrect snapshots could close or duplicate issues, though guards and tests reduce that risk.
Overview
Makes vulnerability triage keep Linear in sync with the current scanner snapshot: create/reopen/skip on the way in, and auto-close pipeline-managed issues when their finding ID is no longer present—including on clean scans.
Fail-closed reconciliation: Dependabot/CodeQL fetch failures and missing tokens now exit the job instead of writing empty alert files, so incomplete data cannot mass-close issues. The Linear triage job runs when
check-alertssucceeds and scan succeeded or was skipped (not after a failed scan).Matching: Linear lookup uses team-scoped
startsWithon[repo] finding-id:titles, with shared jq scripts for exact finding-ID parsing (including CodeQL IDs with colons), open-vs-closed preference, and duplicate markers. A new step paginates open managed issues and moves resolved ones to a completed workflow state (skipped in dry-run).Adds a shell regression suite for match/classify behavior and wires it into the PR Test workflow; CHANGELOG notes the behavior change.
Reviewed by Cursor Bugbot for commit 950c111. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
New Features
Bug Fixes
Tests
Documentation