From 118f30f0de2675c0880801e7379f70fadf99e156 Mon Sep 17 00:00:00 2001 From: Robert DeLanghe Date: Thu, 30 Jul 2026 22:44:40 +0000 Subject: [PATCH 1/2] =?UTF-8?q?ci:=20drop=20adoption=20grace=20=E2=80=94?= =?UTF-8?q?=20run=20the=20osv=20lane=20at=20hard-fail=20(ci-workflows#8)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The report-only flag was adoption grace so a pre-existing advisory could not block instrumentation. It was always meant to be temporary, and it has no expiry or owner, so a repo left holding it shows a green check that gates nothing. This repo's scan is clean, so grace comes off: a known vulnerability now reds the lane, which is the template's intended steady state. Self-verifying by construction — if this repo did still carry a finding, this PR's own osv check goes red and it does not get merged. Co-Authored-By: Claude Opus 5 --- .github/workflows/deps.yml | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml index ff49a10..8dbf430 100644 --- a/.github/workflows/deps.yml +++ b/.github/workflows/deps.yml @@ -13,18 +13,8 @@ name: deps # (OSV has no JSR ecosystem). A repo with nothing scannable passes rather than # red-lining. # -# Failure posture is HARD-FAIL by default. This template ships `report-only: true` -# as an ADOPTION GRACE setting: 5 of the first 8 repos scanned carried pre-existing -# advisories, and blocking adoption on remediation would mean most repos stay -# UNINSTRUMENTED while their findings go unseen. Grace decouples "we can see it" -# from "we have fixed it". -# -# >>> DELETE THE `report-only: true` LINE BELOW once this repo's findings are clear. -# >>> That flips it to hard-fail, which is the intended steady state. -# Progress tracked in ci-workflows#2. -# -# Grace downgrades VULNERABILITY findings only. A tool or network failure still fails -# hard in every mode — a lane that cannot run must never report green. +# Failure posture: HARD-FAIL. Adoption grace was removed once this repo's scan +# came back clean (ci-workflows#8) — a known vulnerability now reds the lane. # # The reviewable escape hatch for an accepted or unfixable finding is an # osv-scanner.toml [[IgnoredVulns]] entry next to the lockfile, with a written reason. @@ -54,5 +44,3 @@ jobs: # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a # reviewer can tell an intentional bump from a drifted one. uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@62990dd15f1b0deba21e597bebd1512970544c15 # main - with: - report-only: true # adoption grace — delete this once findings are clear (ci-workflows#2) From bde907771469ec8fe4d2ec93377baf89503f397f Mon Sep 17 00:00:00 2001 From: Robert DeLanghe Date: Thu, 30 Jul 2026 23:12:59 +0000 Subject: [PATCH 2/2] deps: crossbeam-epoch 0.9.18 -> 0.9.20 (RUSTSEC-2026-0204) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removing report-only grace turned this lane red on the first non-npm finding of the fleet sweep — a Rust advisory from Cargo.lock rather than a JS one. Patch-level bump inside the existing range; cargo update touched one package and nothing else. No manifest change. Co-Authored-By: Claude Opus 5 --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 9989f5e..a6b7424 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -177,9 +177,9 @@ dependencies = [ [[package]] name = "crossbeam-epoch" -version = "0.9.18" +version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" +checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f" dependencies = [ "crossbeam-utils", ]