[MAIN-HEALTH-SEC-002] Restore dependency security gates - #3673
[MAIN-HEALTH-SEC-002] Restore dependency security gates#3673ootakazuhiko wants to merge 15 commits into
Conversation
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
ootakazuhiko
added
risk:high
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CodeX Artifacts Summary
|
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
Generate Artifacts PreviewGenerated at: 2026-07-31T01:21:32.257Z
|
KvOnce Trace Validation
|
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
Cedar Policies (report-only)Files: 1 (json=0, cedar=0) Policy: report-only |
AE-Spec Validation ReportStatus: ✅ Passed Validation Results
AE-IR Summary
BDD Step Lint (non-blocking)Usecases: 1 Issues: 1
|
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CodeX Artifacts Summary
|
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CodeX Artifacts Summary
|
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CodeX Artifacts Summary
|
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CodeX Artifacts Summary
|
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
CodeX Artifacts Summary
|
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CI recovery record
|
❓ Code Generation Drift DetectionStatus: Automated by AE-Framework Codegen |
CodeX Artifacts Summary
|
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
Exact-head Security workflow verification — blocked by #3672The contradictory workflow result in run 30536784184 was reproduced twice before changing source: All materialized jobs were success/skipped, while the reusable SBOM jobs were absent and the workflow concluded failure. The root cause was a caller/reusable-workflow concurrency collision: both workflows used the caller-derived Fix commit:
Post-fix trusted runs prove that reusable SBOM generation and its enforced dependency analysis now execute and succeed: Both overall runs still conclude failure because Container Security hits The current goal prohibits starting #3672. Therefore two workflow-level trusted successes cannot yet be obtained. PR #3673 remains Draft and must not be merged until #3672 is authorized/completed and the trusted Security Analysis path succeeds twice. |
🔍 Verification Summary
Unlinked (top 5)Linked examples (up to 3)Hit basis (tests/formal)- Test hits: title=0 id=0 tag=0 - Formal hits: title=0 id=0 tag=0Non-OK completed modules (top 5)Alloy non-OK completed executions (top 5) |
CodeX Artifacts Summary
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 058975117e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # A reusable workflow inherits the caller name in github.workflow. Keep this | ||
| # namespace independent from the caller's workflow-level concurrency key so | ||
| # the reusable invocation cannot cancel its own caller. | ||
| group: sbom-generation-${{ github.ref }} |
There was a problem hiding this comment.
When a standalone SBOM run and the reusable SBOM job overlap on the same ref—for example, a main push or /run-security-dispatch while the scheduled/manual security.yml call is running—both now use this identical repository-wide concurrency group. Because cancel-in-progress is enabled, the newer invocation cancels the other; cancelling the reusable invocation also leaves the parent Security Analysis run without its SBOM result. Include the invocation context or run identity in this namespace while keeping it distinct from the caller's own group.
AGENTS.md reference: AGENTS.md:L22-L22
Useful? React with 👍 / 👎.
Summary
Implements #3671 under parent program #3655.
Restores the dependency-security gates that currently block #3658 by removing every high/critical advisory reported by the repository-pinned pnpm 10.0.0 audit paths. Related historical remediation: #3591 and #2472.
spec/context-pack/boundary-map.jsonreserves inventory/reservation domains only)Source / Scope
mainatc5da6115638fdbfeebbc458b39fa6916db66afb0058975117e87b30c223d0b6c0f9eddd12810319bAudit counts
pnpm audit --audit-level=moderate --jsonpnpm audit --prod --jsonThe initial full audit contained 14 high advisory objects (7 direct / 7 transitive). Twelve reached a production dependency path; two were test/development-only advisory surfaces.
pnpmmetadata counted 19 full-tree and 12 production-tree high vulnerability occurrences.High advisory inventory and remediation
@opentelemetry/propagator-jaeger@2.8.00.220.0/2.9.0family updatebrace-expansion@1.1.12,2.0.2brace-expansion@5.0.8plus reviewed minimatch 3/5/9 export adaptersbrace-expansion@1.1.12,2.0.2,5.0.7fast-uri@3.1.33.1.4overridefind-my-way@9.6.05.10.0+ compatiblefind-my-way@9.7.0overridejs-yaml@4.1.1,3.14.24.3.0; major-scoped overrides3.15.0/4.3.0next@15.5.1815.5.21next@15.5.1815.5.21next@15.5.1815.5.21postcss@8.4.31,8.5.68.5.25overridepostcss@8.4.31,8.5.68.5.25remediationsharp@0.32.6,0.34.50.35.3override; web and Storybook builds exercisedThe two js-yaml and three Next advisory IDs share package-level remediation rows above. No high/critical advisory is waived or filtered.
Historical comparison: the external dependency versions were not reintroduced by a reviewed dependency change after #3591 completion. The current high set is dominated by advisories published on 2026-07-20 through 2026-07-27 against versions that had remained in the lockfile.
Dependency changes
Compatible direct updates
15.5.18 -> 15.5.21^5.9.0 -> ^5.10.0^4.1.1 -> ^4.3.0in root and spec compiler^8.4.35 -> ^8.5.180.219/2.8 -> 0.220/2.9Reviewed overrides and compatibility patches
fast-uri=3.1.4,find-my-way=9.7.0,postcss=8.5.25js-yaml@3=3.15.0,js-yaml@4=4.3.0sharp=0.35.3brace-expansion=5.0.8expandexport without changing matching semanticsLicenses remain within the existing set: MIT, ISC, Apache-2.0, and BSD-3-Clause. Candidate engines cover repository-supported Node 20.11 and Node 22; the packages also declare Node 24-compatible ranges, while the repository itself continues to declare
<23and does not add Node 24 support in this PR.Reachability limits
Compatibility and CI hardening
packages/andapps/and use--frozen-lockfile; the Podman literalpackages/*importer and non-frozen fallback were removed..codex-localstate and treats onlyENOENTraces as disappeared entries. Non-ENOENT failures, symlink rejection, and workspace path boundaries remain fail closed.30536784184,30565345179, and30565640328exposed a caller/reusable-workflow concurrency collision: bothsecurity.ymland the calledsbom-generation.ymlused${{ github.workflow }}-${{ github.ref }}. GitHub documents that a called workflow inherits the caller name ingithub.workflow, so the shared key can cancel the caller before reusable jobs materialize. The SBOM workflow now uses the caller-independentsbom-generation-${{ github.ref }}namespace, guarded by a workflow regression test.30534618009on prior head40a2b799exposed a pre-existing timeout-edge defect: the detector killed each healthy CI-fast observation at 90/120 seconds, and that head crossed the workflow's 10-minute boundary by about ten seconds. The detector now allows four minutes plus a bounded 30-second hard-stop grace, and both the primary and retry steps remain bounded at 15 minutes. Run count, flake threshold, failure classification, andcontinue-on-errorpolicy are unchanged.Validation
Completed locally on the final candidate:
10.0.0clean frozen installpnpm -s run build,api:check,types:check,check:schemas,check:doc-consistency,verify:litegit diff origin/main...HEAD --checkLock and container reproducibility:
git archivetrees and independent stores: byte-identical3f7e150d399628a1a154a5d198658080ef2864b6433f24118419ef21e8091f36The repository has no
pnpm checkscript; its constituent build, type, schema, documentation, lint, test, and verify checks were executed explicitly.Risk Classification
risk:highrun-securityenforce-testingenforce-securityis referenced by workflows but is not currently present in the repository label catalog; this PR does not create undeclared labels. Strict success is instead demonstrated by zero high/critical findings and the enforced workflow paths available on the exact head.Rollback
Revert these commits in reverse order:
05897511isolate reusable SBOM concurrency from the Security Analysis caller30e827c8let flake detection observe completed suites40a2b799align lock with real reproducibility installe35e690atolerate volatile private profile state363b6d29normalize minimatch patch metadataec6c544finstall complete container test workspace585498cerecord dependency compatibility evidenceea13478epreserve verify-lite summary on compatibility failurec5807f71package dependency patches in container buildsd112551fenforce dependency compatibility in verify-lite777cc03dinclude dependency patches in sparse validationb7a0f1c7stabilize patched lockfile peer snapshots5f2bc377compatibility tests4a371592transitive overrides and minimatch adaptersb4f09b02direct dependency updatesNo schema migration, data migration, or feature flag is involved.
Authority / CI
sha256:d6fcff3125de9bc3286c302b1533d7730c88e36c041e3aa9cadccaff0ca7cd2105897511; final capture is pending trusted Security Analysis completion.dod: linting, coverage, security)failure, all materialized jobs success/skipped, reusable SBOM jobs absent.failureonly because Container Security fails with the separately tracked [MAIN-HEALTH-CI-003] Restore Container Security after Podman/crun runtime incompatibility #3672crun: unknown version specifiedregression on hosted runner imageubuntu24/20260726.254.1.1 total / 0 unresolvedRemaining advisories and decisions
30536784184was a repository orchestration defect, not a GitHub run-metadata anomaly. The reusable SBOM job inherited the Security Analysis workflow name and collided with the caller concurrency key.05897511repairs that collision without weakening any security job, threshold, or result.ubuntu24/20260726.254.1reproducibly fails Container Security before the first DockerfileRUNcommand withcrun: unknown version specified; two independent post-fix runs ineastus2andeastusshow the same failure. This exact defect is the scope and acceptance boundary of open Issue [MAIN-HEALTH-CI-003] Restore Container Security after Podman/crun runtime incompatibility #3672.