feat(ci): add weekly OSV-Scanner version bump workflow#90
feat(ci): add weekly OSV-Scanner version bump workflow#90Kartikeya-trivedi wants to merge 2 commits into
Conversation
Checks the latest google/osv-scanner release weekly; when newer than the pinned version, extracts the linux_amd64 checksum from the release's official SHA256SUMS, cross-verifies it against the downloaded binary, rewrites OSV_VERSION and EXPECTED_SHA, and opens a PR for review. Preserves the pin + checksum supply-chain guard while removing the manual monthly bump. Signed-off-by: Kartikeya Trivedi <kartikeyatrivedi4oct2004@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
🎉 Welcome to the Kubeflow MCP Server! 🎉 Thanks for opening your first PR! We're happy to have you as part of our community 🚀 Here's what happens next:
Join the community:
Feel free to ask questions in the comments if you need any help or clarification! |
There was a problem hiding this comment.
Pull request overview
Adds weekly automation to discover new OSV-Scanner releases, verify checksums, update the pinned scanner workflow, and open a review PR.
Changes:
- Checks weekly for new releases.
- Verifies the downloaded binary against release checksums.
- Updates the scanner pin and creates a security-labeled PR.
Validate upstream version strings as strict X.Y.Z before they reach shell interpolation; reuse compare_versions.py so rollbacks/downgrades no-op instead of opening a downgrade PR; move the pin rewrite into update_scanner_pin.py which requires exactly one replacement of each line and fails rather than opening a half-updated PR (with tests); pin create-pull-request to its immutable v8 commit; document that pushing workflow-file changes needs a WORKFLOW_BUMP_TOKEN with workflow scope since GITHUB_TOKEN cannot be granted it. Signed-off-by: Kartikeya Trivedi <kartikeyatrivedi4oct2004@gmail.com>
|
@abhijeet-dhumal this is the follow-up I promised on the checksum-drift thread in #30, the weekly auto-bump for the OSV-Scanner pin, so the version + checksum never go stale silently again. Same trust model as before: checksum comes from the release's official SHA256SUMS, gets cross-verified against the downloaded binary, and a human still reviews every bump PR before merge. Copilot's review already caught some good stuff (token scope, input validation, downgrade guard), all addressed in 07f4d0d, with the rewrite logic extracted into a tested helper per the repo convention we set up in #30. Would appreciate a review when you get a chance 🙏 |
|
/ok-to-test |
Krishna-kg732
left a comment
Krishna-kg732
left a comment
There was a problem hiding this comment.
Hey @Kartikeya-trivedi thanks for picking this up, can you please take a look at how the sdk handles the version bumps using osv scanner
There was a problem hiding this comment.
rename the file to be consistent with the sdk repo's workflow for the same , ie; osv-scanner.yaml
| @@ -0,0 +1,112 @@ | |||
| name: OSV-Scanner Version Bump | |||
There was a problem hiding this comment.
check the sdk's implementation of the same at : https://github.com/kubeflow/sdk/blob/main/.github/workflows/osv-scanner.yaml
There was a problem hiding this comment.
Thanks @Krishna-kg732 for pointing this out..
@Kartikeya-trivedi can we follow the similar analogy if possible?
There was a problem hiding this comment.
Hey @abhijeet-dhumal , do we want this workflow similar to how we have it in SDK? wdyt
|
Hi @abhijeet-dhumal , @Krishna-kg732 sdk's file still says "Dependabot cannot bump curl-installed binaries — update version + checksum manually" , the exact manual chore this PR eliminates. |
Description
Follow-up from the checksum-drift review thread on #30: the pinned
OSV_VERSION+EXPECTED_SHAis the right supply-chain pattern for acontents: writeworkflow, but bumping it was a manual monthly chore and nothing alerted when the pin went stale.This adds a weekly workflow (Mondays 03:00 UTC +
workflow_dispatch) that:google/osv-scannerrelease, and exits quietly if we're already on itlinux_amd64checksum from the release's officialosv-scanner_SHA256SUMSOSV_VERSION/EXPECTED_SHAlines inosv-scanner.yamland opens a PR for human reviewThe pin + checksum guard stays exactly as it is — this only removes the manual chore. A human still reviews every bump PR before it merges.
Validated the plumbing end-to-end against real releases: the extraction reproduces the v2.3.8 checksum we originally pinned byte-for-byte, and correctly detected the 2.3.8 -> 2.4.0 bump (which #30 then picked up manually). Since #30 merged with 2.4.0 pinned, this workflow's first runs will no-op until the next osv-scanner release.
Note: the bump PRs this creates need the same two admin settings as the auto-fix PRs from #30 (
area/securitylabel + Actions "allow create PRs").Planning to mirror this to kubeflow/sdk as well, since it has the same manual-bump chore.
Type of Change
Checklist
make test-python)make verify)Related Issues
Follow-up to #30 (checksum-drift review thread)