From 1ee4d7e53463334812f543330a943ce5edaeb948 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Tue, 20 Oct 2026 02:20:51 +0800 Subject: [PATCH 1/6] ci: add security-focused Landing bump automation --- .github/LANDING.md | 58 ++++++++++++++ .github/workflows/landing-bump.yml | 117 +++++++++++++++++++++++++++++ 2 files changed, 175 insertions(+) create mode 100644 .github/LANDING.md create mode 100644 .github/workflows/landing-bump.yml diff --git a/.github/LANDING.md b/.github/LANDING.md new file mode 100644 index 00000000..8401f4ab --- /dev/null +++ b/.github/LANDING.md @@ -0,0 +1,58 @@ +# Landing security remediation + +`landing-bump.yml` checks open Dependabot alerts weekly (Monday, 02:23 UTC), +on manual dispatch, or when a forwarded alert arrives. It creates draft security +remediation PRs and repairs relevant failed `Main` dependency PRs. Routine upgrades, +general reviews and triage are outside its scope. No dependencies are bumped here. + +## Enable + +Set repository variable `LANDING_MODEL` to a provider/model identifier and secret +`LANDING_API_KEY` to its key. Without the model variable the job skips. Optional +variables are `LANDING_API_BASE` and JSON `LANDING_COMPLETION_ARGS`. +Set `LANDING_BUMP_ON_FAILURE=false` to disable automatic repair. + +Prepare secret `LANDING_GITHUB_TOKEN` with repository contents, pull requests, +issues and Actions write access and Dependabot alerts read access. Use an +organization-owned App or authorized machine account whose writes trigger +independent CI. Set `LANDING_GIT_NAME` and `LANDING_GIT_EMAIL` for its commit +identity. Optional `LANDING_ADMISSION_TOKEN` separates admission from publication. +The fallback workflow token needs repository permission to create PRs and cannot +trigger `Main` from its own writes. `Main` has no manual dispatch; missing +independent CI is a blocker, not permission to change native CI or claim success. + +Repair admission accepts Dependabot, Renovate and the prepared publisher on +`deps/landing-*` branches. Landing validates an unambiguous open same-repository +PR matching the failed run; the task must also establish its security purpose +before editing. The runner initially checks out the trusted default branch. + +The public Action is pinned to Landing revision +`9014baa64f82893dc194a3f1e31391737f68c426`; Landing's self-hosted `uses: ./` +example is not used here. See the pinned [Action API](https://github.com/bubbuild/landing/blob/9014baa64f82893dc194a3f1e31391737f68c426/action.yml) +and [GitHub guide](https://github.com/bubbuild/landing/blob/9014baa64f82893dc194a3f1e31391737f68c426/docs/guides/github.md). + +## Forward alerts + +Dependabot alerts are webhooks, not native Actions triggers. A separately deployed +receiver must verify GitHub's webhook signature and dispatch to this repository: + +```json +{ + "event_type": "dependabot_alert", + "client_payload": {"alert_number": 7} +} +``` + +No receiver or subscription is installed here. Scheduled/manual scans work without +one. Fixed/dismissed alerts authorize no upgrades; unavailable alert access leaves +coverage unknown. Listeners must reach the default branch before receiving these +events. See [GitHub events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows). + +## Validate candidates + +Use `uv` and `pnpm` for scoped manifest/lock changes, preserving constraints and +Bub's hatch-vcs version policy. Run `make check`, `make test` and affected website +checks, then verify independent `Main` results for the candidate head (Python +3.12/3.13/3.14 and docs). New candidates remain drafts; repairs retain the PR's +status and branch. Maintainers control merges, releases and dismissals. +Landing evidence is retained as a workflow artifact for 14 days. diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml new file mode 100644 index 00000000..154af69a --- /dev/null +++ b/.github/workflows/landing-bump.yml @@ -0,0 +1,117 @@ +name: Landing security bump + +on: + schedule: + - cron: '23 2 * * 1' + workflow_dispatch: + repository_dispatch: + types: [dependabot_alert] + workflow_run: + workflows: [Main] + types: [completed] + +permissions: + contents: write + issues: write + pull-requests: write + actions: write + vulnerability-alerts: read + +jobs: + bump: + if: >- + vars.LANDING_MODEL != '' && + (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || + github.event_name == 'repository_dispatch' || + (github.event_name == 'workflow_run' && + github.event.workflow_run.conclusion == 'failure' && + github.event.workflow_run.head_repository.full_name == github.repository && + github.event.workflow_run.event == 'pull_request' && + vars.LANDING_BUMP_ON_FAILURE != 'false')) + concurrency: + group: landing-security-bump-${{ github.repository_id }} + cancel-in-progress: false + runs-on: ubuntu-latest + timeout-minutes: 30 + env: + GH_ADMISSION_TOKEN: ${{ secrets.LANDING_ADMISSION_TOKEN || github.token }} + GH_TOKEN: ${{ secrets.LANDING_GITHUB_TOKEN || github.token }} + GIT_AUTHOR_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }} + GIT_AUTHOR_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }} + GIT_COMMITTER_NAME: ${{ vars.LANDING_GIT_NAME || 'github-actions[bot]' }} + GIT_COMMITTER_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }} + steps: + - name: Check out trusted default branch + uses: actions/checkout@v6 + with: + ref: ${{ github.event.repository.default_branch }} + fetch-depth: 0 + persist-credentials: false + - name: Set up Python dependencies + uses: ./.github/actions/setup-python-env + with: + python-version: '3.12' + - uses: pnpm/action-setup@v6 + with: + package_json_file: website/package.json + - uses: actions/setup-node@v6 + with: + node-version-file: website/.node-version + - name: Prepare website dependencies and Git authentication + run: | + pnpm --dir website install --frozen-lockfile + gh auth setup-git + git var GIT_AUTHOR_IDENT + git var GIT_COMMITTER_IDENT + - name: Identify Landing dependency PR publisher + if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-') + run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV" + - name: Remediate vulnerable dependencies + uses: bubbuild/landing@9014baa64f82893dc194a3f1e31391737f68c426 + env: + LANDING_MODEL: ${{ vars.LANDING_MODEL }} + LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }} + LANDING_API_BASE: ${{ vars.LANDING_API_BASE }} + LANDING_COMPLETION_ARGS: ${{ vars.LANDING_COMPLETION_ARGS || '{}' }} + with: + command: bump + upstream-workflow: Main + bump-on-failure: ${{ vars.LANDING_BUMP_ON_FAILURE || 'true' }} + dependency-update-actors: | + dependabot[bot] + renovate[bot] + ${{ env.LANDING_PUBLISHING_ACTOR }} + checked-revision: '' + checks: | + make check + make test + instruction: >- + Remediate security vulnerabilities only. Follow AGENTS.md and CONTRIBUTING.md on main. + For scheduled or manual work, inspect open Dependabot alerts and act only on confirmed vulnerable + dependencies. For a supplied alert, verify current state, affected path and patched target; + fixed or dismissed alerts authorize no upgrade. If alert access is unavailable, report unknown + coverage and stop. Do not perform routine upgrades, general review, issue triage or unrelated cleanup. + For failed Main runs, inspect only the supplied same-repository dependency PR, verify its current + head and completed failed checks, and establish that it remediates a security vulnerability before + editing. Skip routine dependency PRs. Make only necessary compatibility repairs preserving the + security fix on the existing branch; never force-push or create a replacement PR. + Use uv for Python and pnpm for website dependencies, preserve constraint style, and update only + affected manifests and lockfiles with the smallest patched resolution. Bub uses hatch-vcs: + do not edit generated _version.py, change fallback-version, create tags or alter release-main. + Reuse matching open PRs. Publish new candidates only as English draft PRs on deps/landing-* + branches with Conventional Commit titles, advisory references, paths, versions and validation. + Run make check, make test and affected website checks. Preserve independent Main CI across + Python 3.12, 3.13 and 3.14 and the docs build. Ensure independent Main CI runs for the exact + candidate head; GITHUB_TOKEN writes alone do not trigger it and Main has no workflow_dispatch. + If prepared credentials cannot trigger CI, report the blocker without weakening checks or + changing native workflows. Track only confirmed security exposure or remediation blockers when + necessary, reusing issues and avoiding unchanged updates. No merge, release or alert dismissal + is authorized; maintainers make those decisions. + - name: Retain Landing evidence + if: always() + uses: actions/upload-artifact@v6 + with: + name: landing-security-bump-${{ github.run_id }}-${{ github.run_attempt }} + path: ${{ runner.temp }}/landing/ + retention-days: 14 + if-no-files-found: ignore From 69c73cd46c599171fe5c366ad8d8d9559040dce7 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Tue, 20 Oct 2026 02:23:22 +0800 Subject: [PATCH 2/6] docs: clarify reuse of existing Landing configuration --- .github/LANDING.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/LANDING.md b/.github/LANDING.md index 8401f4ab..e96d366d 100644 --- a/.github/LANDING.md +++ b/.github/LANDING.md @@ -7,9 +7,12 @@ general reviews and triage are outside its scope. No dependencies are bumped her ## Enable -Set repository variable `LANDING_MODEL` to a provider/model identifier and secret -`LANDING_API_KEY` to its key. Without the model variable the job skips. Optional -variables are `LANDING_API_BASE` and JSON `LANDING_COMPLETION_ARGS`. +Reuse the existing Landing/Republic configuration: secret `LANDING_API_KEY` and +repository variables `LANDING_MODEL`, `LANDING_API_BASE` and JSON +`LANDING_COMPLETION_ARGS`. No separate model key is needed for Bub. When setting +up a new repository, provision the same authorized configuration through secure +secret management; GitHub cannot reveal existing secret values. Without +`LANDING_MODEL` the job skips. Set `LANDING_BUMP_ON_FAILURE=false` to disable automatic repair. Prepare secret `LANDING_GITHUB_TOKEN` with repository contents, pull requests, From bac799276dbf2008a6cbe4be0a627d5f5465bb41 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Tue, 20 Oct 2026 02:25:37 +0800 Subject: [PATCH 3/6] ci: clarify closed security alert reconciliation --- .github/LANDING.md | 9 ++++++--- .github/workflows/landing-bump.yml | 6 ++++-- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/LANDING.md b/.github/LANDING.md index e96d366d..8becd979 100644 --- a/.github/LANDING.md +++ b/.github/LANDING.md @@ -3,7 +3,7 @@ `landing-bump.yml` checks open Dependabot alerts weekly (Monday, 02:23 UTC), on manual dispatch, or when a forwarded alert arrives. It creates draft security remediation PRs and repairs relevant failed `Main` dependency PRs. Routine upgrades, -general reviews and triage are outside its scope. No dependencies are bumped here. +general reviews and general issue triage are outside its scope. No dependencies are bumped here. ## Enable @@ -47,8 +47,11 @@ receiver must verify GitHub's webhook signature and dispatch to this repository: ``` No receiver or subscription is installed here. Scheduled/manual scans work without -one. Fixed/dismissed alerts authorize no upgrades; unavailable alert access leaves -coverage unknown. Listeners must reach the default branch before receiving these +one. Open alerts route to bump. Fixed/dismissed alerts intentionally route through +Landing triage to reconcile existing tracked remediation, even though the workflow +requests `command: bump`. This narrow reconciliation authorizes no upgrade or +general triage; dismissal alone does not prove repair. Unavailable alert access +leaves coverage unknown. Listeners must reach the default branch before receiving these events. See [GitHub events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows). ## Validate candidates diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 154af69a..8e7565fd 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -89,8 +89,10 @@ jobs: Remediate security vulnerabilities only. Follow AGENTS.md and CONTRIBUTING.md on main. For scheduled or manual work, inspect open Dependabot alerts and act only on confirmed vulnerable dependencies. For a supplied alert, verify current state, affected path and patched target; - fixed or dismissed alerts authorize no upgrade. If alert access is unavailable, report unknown - coverage and stop. Do not perform routine upgrades, general review, issue triage or unrelated cleanup. + fixed or dismissed alerts intentionally route through Landing triage only to reconcile existing + tracked remediation, without an upgrade. Dismissal alone does not prove repair. If alert access + is unavailable, report unknown coverage and stop. Do not perform routine upgrades, general review, + general issue triage or unrelated cleanup. For failed Main runs, inspect only the supplied same-repository dependency PR, verify its current head and completed failed checks, and establish that it remediates a security vulnerability before editing. Skip routine dependency PRs. Make only necessary compatibility repairs preserving the From 2300f1f947969a0d093963a265c82a4f761ae761 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Tue, 20 Oct 2026 02:28:28 +0800 Subject: [PATCH 4/6] ci: dispatch native Main checks for Landing candidates --- .github/LANDING.md | 38 ++++++++++++++++++++---------- .github/workflows/landing-bump.yml | 14 +++++++---- .github/workflows/main.yml | 1 + 3 files changed, 37 insertions(+), 16 deletions(-) diff --git a/.github/LANDING.md b/.github/LANDING.md index 8becd979..04d0d1f1 100644 --- a/.github/LANDING.md +++ b/.github/LANDING.md @@ -15,19 +15,23 @@ secret management; GitHub cannot reveal existing secret values. Without `LANDING_MODEL` the job skips. Set `LANDING_BUMP_ON_FAILURE=false` to disable automatic repair. -Prepare secret `LANDING_GITHUB_TOKEN` with repository contents, pull requests, -issues and Actions write access and Dependabot alerts read access. Use an -organization-owned App or authorized machine account whose writes trigger -independent CI. Set `LANDING_GIT_NAME` and `LANDING_GIT_EMAIL` for its commit -identity. Optional `LANDING_ADMISSION_TOKEN` separates admission from publication. -The fallback workflow token needs repository permission to create PRs and cannot -trigger `Main` from its own writes. `Main` has no manual dispatch; missing -independent CI is a blocker, not permission to change native CI or claim success. +The workflow token is the default publishing/admission identity. Its explicit +workflow permissions grant contents, issues, pull requests and Actions write +access plus Dependabot alerts read access. Repository settings allow PR creation. +After creating or repairing a candidate, Landing explicitly dispatches `Main` +on its branch, so native checks run even when the workflow token authored the push. + +Optional `LANDING_GITHUB_TOKEN` overrides publication; `LANDING_ADMISSION_TOKEN` +separately overrides admission. Preserve these existing conventions when using +an organization-owned App or authorized machine account. Set `LANDING_GIT_NAME` +and `LANDING_GIT_EMAIL` for that account's commit identity. Repair admission accepts Dependabot, Renovate and the prepared publisher on -`deps/landing-*` branches. Landing validates an unambiguous open same-repository -PR matching the failed run; the task must also establish its security purpose -before editing. The runner initially checks out the trusted default branch. +`deps/landing-*` branches. Optional `LANDING_DEPENDENCY_UPDATE_ACTORS` adds allowed +logins, one per line. Only failed `Main` PR runs or dispatches on non-default +candidate branches qualify. Landing validates an unambiguous open same-repository +PR matching the failed run; the task must establish its security purpose before +editing. The runner initially checks out the trusted default branch. The public Action is pinned to Landing revision `9014baa64f82893dc194a3f1e31391737f68c426`; Landing's self-hosted `uses: ./` @@ -59,6 +63,16 @@ events. See [GitHub events](https://docs.github.com/en/actions/reference/workflo Use `uv` and `pnpm` for scoped manifest/lock changes, preserving constraints and Bub's hatch-vcs version policy. Run `make check`, `make test` and affected website checks, then verify independent `Main` results for the candidate head (Python -3.12/3.13/3.14 and docs). New candidates remain drafts; repairs retain the PR's +3.12/3.13/3.14 and docs). After each candidate push, dispatch the unchanged native +jobs on the candidate branch: + +```bash +gh workflow run main.yml --ref +``` + +Verify the run's `head_sha` matches the published candidate head; a superseded +head needs fresh checks. Successful runs require no Landing follow-up. Failed +candidate dispatches can enter the same scoped repair path as failed PR runs. +New candidates remain drafts; repairs retain the PR's status and branch. Maintainers control merges, releases and dismissals. Landing evidence is retained as a workflow artifact for 14 days. diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 8e7565fd..8c79f14c 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -26,7 +26,9 @@ jobs: (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.head_repository.full_name == github.repository && - github.event.workflow_run.event == 'pull_request' && + (github.event.workflow_run.event == 'pull_request' || + (github.event.workflow_run.event == 'workflow_dispatch' && + github.event.workflow_run.head_branch != github.event.repository.default_branch)) && vars.LANDING_BUMP_ON_FAILURE != 'false')) concurrency: group: landing-security-bump-${{ github.repository_id }} @@ -81,6 +83,7 @@ jobs: dependabot[bot] renovate[bot] ${{ env.LANDING_PUBLISHING_ACTOR }} + ${{ vars.LANDING_DEPENDENCY_UPDATE_ACTORS }} checked-revision: '' checks: | make check @@ -104,9 +107,12 @@ jobs: branches with Conventional Commit titles, advisory references, paths, versions and validation. Run make check, make test and affected website checks. Preserve independent Main CI across Python 3.12, 3.13 and 3.14 and the docs build. Ensure independent Main CI runs for the exact - candidate head; GITHUB_TOKEN writes alone do not trigger it and Main has no workflow_dispatch. - If prepared credentials cannot trigger CI, report the blocker without weakening checks or - changing native workflows. Track only confirmed security exposure or remediation blockers when + candidate head. After every new draft or repair push, dispatch main.yml at the candidate branch + using gh workflow run main.yml --ref . GITHUB_TOKEN writes alone do not + trigger CI, but explicit workflow_dispatch does. Verify the dispatched run head_sha matches + the published candidate head; stop and refresh if superseded. Do not wait for this Landing + feedback job itself. Report dispatch failures without weakening native checks. + Track only confirmed security exposure or remediation blockers when necessary, reusing issues and avoiding unchanged updates. No merge, release or alert dismissal is authorized; maintainers make those decisions. - name: Retain Landing evidence diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index db60296b..434439bf 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,6 +1,7 @@ name: Main on: + workflow_dispatch: push: branches: - main From affbb8856efa916c9627eeacabbd82713311fcea Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Tue, 20 Oct 2026 02:30:43 +0800 Subject: [PATCH 5/6] ci: simplify Landing bump workflow --- .github/LANDING.md | 78 ------------------------------ .github/workflows/landing-bump.yml | 43 +++------------- 2 files changed, 7 insertions(+), 114 deletions(-) delete mode 100644 .github/LANDING.md diff --git a/.github/LANDING.md b/.github/LANDING.md deleted file mode 100644 index 04d0d1f1..00000000 --- a/.github/LANDING.md +++ /dev/null @@ -1,78 +0,0 @@ -# Landing security remediation - -`landing-bump.yml` checks open Dependabot alerts weekly (Monday, 02:23 UTC), -on manual dispatch, or when a forwarded alert arrives. It creates draft security -remediation PRs and repairs relevant failed `Main` dependency PRs. Routine upgrades, -general reviews and general issue triage are outside its scope. No dependencies are bumped here. - -## Enable - -Reuse the existing Landing/Republic configuration: secret `LANDING_API_KEY` and -repository variables `LANDING_MODEL`, `LANDING_API_BASE` and JSON -`LANDING_COMPLETION_ARGS`. No separate model key is needed for Bub. When setting -up a new repository, provision the same authorized configuration through secure -secret management; GitHub cannot reveal existing secret values. Without -`LANDING_MODEL` the job skips. -Set `LANDING_BUMP_ON_FAILURE=false` to disable automatic repair. - -The workflow token is the default publishing/admission identity. Its explicit -workflow permissions grant contents, issues, pull requests and Actions write -access plus Dependabot alerts read access. Repository settings allow PR creation. -After creating or repairing a candidate, Landing explicitly dispatches `Main` -on its branch, so native checks run even when the workflow token authored the push. - -Optional `LANDING_GITHUB_TOKEN` overrides publication; `LANDING_ADMISSION_TOKEN` -separately overrides admission. Preserve these existing conventions when using -an organization-owned App or authorized machine account. Set `LANDING_GIT_NAME` -and `LANDING_GIT_EMAIL` for that account's commit identity. - -Repair admission accepts Dependabot, Renovate and the prepared publisher on -`deps/landing-*` branches. Optional `LANDING_DEPENDENCY_UPDATE_ACTORS` adds allowed -logins, one per line. Only failed `Main` PR runs or dispatches on non-default -candidate branches qualify. Landing validates an unambiguous open same-repository -PR matching the failed run; the task must establish its security purpose before -editing. The runner initially checks out the trusted default branch. - -The public Action is pinned to Landing revision -`9014baa64f82893dc194a3f1e31391737f68c426`; Landing's self-hosted `uses: ./` -example is not used here. See the pinned [Action API](https://github.com/bubbuild/landing/blob/9014baa64f82893dc194a3f1e31391737f68c426/action.yml) -and [GitHub guide](https://github.com/bubbuild/landing/blob/9014baa64f82893dc194a3f1e31391737f68c426/docs/guides/github.md). - -## Forward alerts - -Dependabot alerts are webhooks, not native Actions triggers. A separately deployed -receiver must verify GitHub's webhook signature and dispatch to this repository: - -```json -{ - "event_type": "dependabot_alert", - "client_payload": {"alert_number": 7} -} -``` - -No receiver or subscription is installed here. Scheduled/manual scans work without -one. Open alerts route to bump. Fixed/dismissed alerts intentionally route through -Landing triage to reconcile existing tracked remediation, even though the workflow -requests `command: bump`. This narrow reconciliation authorizes no upgrade or -general triage; dismissal alone does not prove repair. Unavailable alert access -leaves coverage unknown. Listeners must reach the default branch before receiving these -events. See [GitHub events](https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows). - -## Validate candidates - -Use `uv` and `pnpm` for scoped manifest/lock changes, preserving constraints and -Bub's hatch-vcs version policy. Run `make check`, `make test` and affected website -checks, then verify independent `Main` results for the candidate head (Python -3.12/3.13/3.14 and docs). After each candidate push, dispatch the unchanged native -jobs on the candidate branch: - -```bash -gh workflow run main.yml --ref -``` - -Verify the run's `head_sha` matches the published candidate head; a superseded -head needs fresh checks. Successful runs require no Landing follow-up. Failed -candidate dispatches can enter the same scoped repair path as failed PR runs. -New candidates remain drafts; repairs retain the PR's -status and branch. Maintainers control merges, releases and dismissals. -Landing evidence is retained as a workflow artifact for 14 days. diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 8c79f14c..231ff80f 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -4,6 +4,7 @@ on: schedule: - cron: '23 2 * * 1' workflow_dispatch: + # External signature-verifying relay required; no receiver is installed here. repository_dispatch: types: [dependabot_alert] workflow_run: @@ -63,8 +64,6 @@ jobs: run: | pnpm --dir website install --frozen-lockfile gh auth setup-git - git var GIT_AUTHOR_IDENT - git var GIT_COMMITTER_IDENT - name: Identify Landing dependency PR publisher if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-') run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV" @@ -89,37 +88,9 @@ jobs: make check make test instruction: >- - Remediate security vulnerabilities only. Follow AGENTS.md and CONTRIBUTING.md on main. - For scheduled or manual work, inspect open Dependabot alerts and act only on confirmed vulnerable - dependencies. For a supplied alert, verify current state, affected path and patched target; - fixed or dismissed alerts intentionally route through Landing triage only to reconcile existing - tracked remediation, without an upgrade. Dismissal alone does not prove repair. If alert access - is unavailable, report unknown coverage and stop. Do not perform routine upgrades, general review, - general issue triage or unrelated cleanup. - For failed Main runs, inspect only the supplied same-repository dependency PR, verify its current - head and completed failed checks, and establish that it remediates a security vulnerability before - editing. Skip routine dependency PRs. Make only necessary compatibility repairs preserving the - security fix on the existing branch; never force-push or create a replacement PR. - Use uv for Python and pnpm for website dependencies, preserve constraint style, and update only - affected manifests and lockfiles with the smallest patched resolution. Bub uses hatch-vcs: - do not edit generated _version.py, change fallback-version, create tags or alter release-main. - Reuse matching open PRs. Publish new candidates only as English draft PRs on deps/landing-* - branches with Conventional Commit titles, advisory references, paths, versions and validation. - Run make check, make test and affected website checks. Preserve independent Main CI across - Python 3.12, 3.13 and 3.14 and the docs build. Ensure independent Main CI runs for the exact - candidate head. After every new draft or repair push, dispatch main.yml at the candidate branch - using gh workflow run main.yml --ref . GITHUB_TOKEN writes alone do not - trigger CI, but explicit workflow_dispatch does. Verify the dispatched run head_sha matches - the published candidate head; stop and refresh if superseded. Do not wait for this Landing - feedback job itself. Report dispatch failures without weakening native checks. - Track only confirmed security exposure or remediation blockers when - necessary, reusing issues and avoiding unchanged updates. No merge, release or alert dismissal - is authorized; maintainers make those decisions. - - name: Retain Landing evidence - if: always() - uses: actions/upload-artifact@v6 - with: - name: landing-security-bump-${{ github.run_id }}-${{ github.run_attempt }} - path: ${{ runner.temp }}/landing/ - retention-days: 14 - if-no-files-found: ignore + Security remediation only: inspect open Dependabot alerts; skip routine upgrades and stop if alert access fails. Closed alerts only reconcile tracked remediation. + For failed CI, verify the supplied security dependency PR's current head and failed checks; make only necessary repairs on its existing branch, without force-push. + Follow AGENTS.md: use uv/pnpm, preserve constraints and hatch-vcs version policy, and keep manifest/lock changes scoped to the security fix. + Reuse matching PRs; publish new candidates as English drafts on deps/landing-* branches with Conventional Commit titles and advisory/version/check evidence. + After each candidate push, run gh workflow run main.yml --ref and verify the run's head_sha matches; report dispatch failures without weakening checks. + Maintainers decide merges, releases and alert dismissal; no general review or triage is authorized. From d23223f76951305f656c0022a53e36d548db5848 Mon Sep 17 00:00:00 2001 From: Chojan Shang Date: Tue, 20 Oct 2026 02:48:25 +0800 Subject: [PATCH 6/6] ci: track latest Landing Action --- .github/workflows/landing-bump.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/landing-bump.yml b/.github/workflows/landing-bump.yml index 231ff80f..6ac081f9 100644 --- a/.github/workflows/landing-bump.yml +++ b/.github/workflows/landing-bump.yml @@ -68,7 +68,7 @@ jobs: if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-') run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV" - name: Remediate vulnerable dependencies - uses: bubbuild/landing@9014baa64f82893dc194a3f1e31391737f68c426 + uses: bubbuild/landing@main env: LANDING_MODEL: ${{ vars.LANDING_MODEL }} LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }}