From bd1bbe5fbd2674f45af4af7a9b18c5000946f125 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Thu, 22 Oct 2026 21:00:10 +0800 Subject: [PATCH 1/4] ci: add security dependency maintenance --- .github/workflows/landing-bump.yml | 114 +++++++++++++++++++++++++++++ .github/workflows/main.yml | 1 + 2 files changed, 115 insertions(+) create mode 100644 .github/workflows/landing-bump.yml diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml new file mode 100644 index 00000000..9a3204fd --- /dev/null +++ b/.github/workflows/landing-bump.yml @@ -0,0 +1,114 @@ +name: Landing security bump + +on: + schedule: + - cron: '23 2 * * 1' + workflow_dispatch: + # External signature-verifying relay required; no receiver is installed here. + repository_dispatch: + types: [dependabot_alert] + workflow_run: + workflows: [Main] + types: [completed] + +permissions: + contents: write + issues: write + pull-requests: write + actions: write + vulnerability-alerts: read + +jobs: + check-alerts: + if: >- + vars.LANDING_MODEL != '' && + (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + vulnerability-alerts: read + outputs: + count: ${{ steps.alerts.outputs.count }} + env: + GH_TOKEN: ${{ secrets.LANDING_GITHUB_TOKEN || github.token }} + GH_REPO: ${{ github.repository }} + steps: + - name: Check open security alerts + id: alerts + run: | + count=$(gh api --method GET "repos/$GH_REPO/dependabot/alerts" -f state=open -f per_page=1 --jq 'length') + echo "count=$count" >> "$GITHUB_OUTPUT" + if [ "$count" -eq 0 ]; then + echo "No open Dependabot alerts." + fi + + bump: + needs: [check-alerts] + if: >- + always() && !cancelled() && vars.LANDING_MODEL != '' && + (((github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && + needs.check-alerts.result == 'success' && needs.check-alerts.outputs.count == '1') || + github.event_name == 'repository_dispatch' || + (github.event_name == 'workflow_run' && + github.event.workflow_run.conclusion == 'failure' && + github.event.workflow_run.head_repository.full_name == github.repository && + (github.event.workflow_run.event == 'pull_request' || + (github.event.workflow_run.event == 'workflow_dispatch' && + github.event.workflow_run.head_branch != github.event.repository.default_branch)) && + vars.LANDING_BUMP_ON_FAILURE != 'false')) + concurrency: + group: landing-security-bump-${{ github.repository_id }} + cancel-in-progress: false + queue: max + runs-on: ubuntu-latest + timeout-minutes: 30 + env: + GH_ADMISSION_TOKEN: ${{ secrets.LANDING_ADMISSION_TOKEN || github.token }} + GH_TOKEN: ${{ secrets.LANDING_GITHUB_TOKEN || github.token }} + GIT_AUTHOR_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }} + GIT_AUTHOR_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }} + GIT_COMMITTER_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }} + GIT_COMMITTER_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }} + steps: + - name: Check out trusted default branch + uses: actions/checkout@v7 + with: + ref: ${{ github.event.repository.default_branch }} + fetch-depth: 0 + persist-credentials: false + - name: Set up Python dependencies + uses: ./.github/actions/setup-python-env + with: + python-version: '3.12' + - name: Prepare GitHub Git authentication + run: gh auth setup-git + - name: Identify Landing dependency PR publisher + if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-') + run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV" + - name: Remediate vulnerable dependencies + uses: bubbuild/landing@main + env: + LANDING_MODEL: ${{ vars.LANDING_MODEL }} + LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }} + LANDING_API_BASE: ${{ vars.LANDING_API_BASE }} + LANDING_COMPLETION_ARGS: ${{ vars.LANDING_COMPLETION_ARGS || '{}' }} + with: + command: bump + upstream-workflow: Main + bump-on-failure: ${{ vars.LANDING_BUMP_ON_FAILURE || 'true' }} + dependency-update-actors: | + dependabot[bot] + renovate[bot] + ${{ env.LANDING_PUBLISHING_ACTOR }} + ${{ vars.LANDING_DEPENDENCY_UPDATE_ACTORS }} + checked-revision: '' + checks: | + make check + make test + instruction: >- + Security remediation only: inspect open Dependabot alerts; skip routine upgrades and stop if alert access fails. Closed alerts only reconcile tracked remediation. + For failed CI, verify the supplied security dependency PR's current head and failed checks; make only necessary repairs on its existing branch, without force-push. + Follow AGENTS.md: use uv, preserve dependency constraints and pinning styles, and keep manifest/lock changes scoped to the security fix. + Reuse matching PRs; publish new candidates as English drafts on deps/landing-* branches with Conventional Commit titles and advisory/version/check evidence. + After each candidate push, run gh workflow run main.yml --ref and verify the run's head_sha matches; report dispatch failures without weakening checks. + Maintainers decide merges, releases and alert dismissal; do not change the package version or generated protocol bindings. No general review or triage is authorized. diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 4e40a810..6ddf4a8d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,6 +1,7 @@ name: Main on: + workflow_dispatch: push: branches: - main From fc65d8c006c91aeb82ee1044a8a02a6ca29f0e2b Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Thu, 22 Oct 2026 21:06:13 +0800 Subject: [PATCH 2/4] ci: reuse existing dependency PRs for security repairs --- .github/workflows/landing-bump.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 9a3204fd..34ec013e 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -107,8 +107,9 @@ jobs: make test instruction: >- Security remediation only: inspect open Dependabot alerts; skip routine upgrades and stop if alert access fails. Closed alerts only reconcile tracked remediation. - For failed CI, verify the supplied security dependency PR's current head and failed checks; make only necessary repairs on its existing branch, without force-push. + Before editing and again before publishing a new draft, inspect open dependency PRs by package, manifest path and patched version. Reuse a matching Dependabot, Renovate or Landing PR; never create a duplicate for the same remediation. + Leave existing candidates with passing or pending CI unchanged. Repair only completed failed CI on the current head, using the original branch and draft status; do not force-push or create a replacement when write access fails. Follow AGENTS.md: use uv, preserve dependency constraints and pinning styles, and keep manifest/lock changes scoped to the security fix. - Reuse matching PRs; publish new candidates as English drafts on deps/landing-* branches with Conventional Commit titles and advisory/version/check evidence. + Publish new candidates as English drafts on deps/landing-* branches with Conventional Commit titles and advisory/version/check evidence. After each candidate push, run gh workflow run main.yml --ref and verify the run's head_sha matches; report dispatch failures without weakening checks. Maintainers decide merges, releases and alert dismissal; do not change the package version or generated protocol bindings. No general review or triage is authorized. From ff2e2019992ddfc2f428276483136e4aa9f1da51 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Thu, 22 Oct 2026 21:10:29 +0800 Subject: [PATCH 3/4] ci: pin security workflow Actions to full commit SHAs --- .github/workflows/landing-bump.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 34ec013e..9e3edcd0 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -71,7 +71,7 @@ jobs: GIT_COMMITTER_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }} steps: - name: Check out trusted default branch - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.repository.default_branch }} fetch-depth: 0 @@ -86,7 +86,7 @@ jobs: if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-') run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV" - name: Remediate vulnerable dependencies - uses: bubbuild/landing@main + uses: bubbuild/landing@9014baa64f82893dc194a3f1e31391737f68c426 env: LANDING_MODEL: ${{ vars.LANDING_MODEL }} LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }} From ff78fc13060af8115f73e558151b745d7167a9ff Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Thu, 22 Oct 2026 23:14:25 +0800 Subject: [PATCH 4/4] ci: use Landing with pinned composite dependencies --- .github/workflows/landing-bump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 9e3edcd0..0f1a3636 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -86,7 +86,7 @@ jobs: if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-') run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV" - name: Remediate vulnerable dependencies - uses: bubbuild/landing@9014baa64f82893dc194a3f1e31391737f68c426 + uses: bubbuild/landing@db2f3fb331d481d6020b8e61284e410bfb1cf21e env: LANDING_MODEL: ${{ vars.LANDING_MODEL }} LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }}