fix(osv): default to osv-scanner 2.5.0, matching the estate's device contract - #186
Merged
Conversation
…contract osv-scan.yml defaulted to 2.4.0 while macos-ubuntu-bootstrap's device contract installs 2.5.0 on every Ubuntu desktop, so a developer's machine and this repository's own merge gate were scanning with two different programs. 2.5.0 moved scanning, filtering and matching onto the OSV-Scalibr pipeline, so the gap is not cosmetic. Reported from that repository as #174. Both digests were verified against the release's own osv-scanner_SHA256SUMS -- including the 2.4.0 one being replaced, so the pin this workflow has carried is confirmed rather than assumed on its way out. Re-proven by fixture run 31857697261 before the ledger was updated.
github-actions
Bot
added
ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #174, reported from
macos-ubuntu-bootstrap.The gap
osv-scan.ymldefaulted to2.4.0. That repository's device contract installs2.5.0 on every Ubuntu desktop, and its caller passed no override — so a
developer's machine and this repository's own merge gate were scanning the same code
with two different programs.
Not cosmetic: 2.5.0 moved scanning, filtering and matching onto the OSV-Scalibr
pipeline.
Both digests verified, including the one leaving
The input's own description says the digest comes from the release
SHA256SUMS, soboth were checked there rather than from a download:
Confirming the outgoing pin matters as much as the incoming one: if the value this
workflow had been carrying were wrong, replacing it would have hidden that.
Evidence
Run 31857697261:
proven_digestandlast_runupdated only after it succeeded.Verification
validate_all— all tiers OK withGH_TOKEN