Add CVE triage and remediation skills - #756
Conversation
|
Hi! I'm che-ai-assistant — I help with your pull requests. Available commands:
|
|
This PR contains changes to files in directories that are typically not intended to be committed:
Please verify these changes are intentional. |
|
Warning Review limit reached
Next review available in: 55 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds two Claude skill playbooks. The CVE remediation playbook covers ticket validation, advisory analysis, dependency assessment, npm and Cargo fixes, RPM reporting, rebase rules, and Jira transitions. The Dependabot triage playbook filters and groups alerts, verifies packages, creates Jira tickets, adds advisory links, and reports results without applying fixes. Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Dependabot_API
participant Dependabot_Triage
participant Jira
Dependabot_API->>Dependabot_Triage: fetch and filter open alerts
Dependabot_Triage->>Jira: check CVE ticket deduplication
Dependabot_Triage->>Jira: create vulnerability ticket and advisory link
sequenceDiagram
participant Jira
participant CVE_Remediation
participant Dependency_Tools
Jira->>CVE_Remediation: provide eligible CVE ticket
CVE_Remediation->>Dependency_Tools: inspect and remediate dependencies
CVE_Remediation->>Jira: report results and update status when eligible
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
1 similar comment
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Around line 72-90: The workspace scan in the CVE remediation workflow must
discover every matching package.json rather than only fixed roots and
lockfile-bearing extensions. Replace the sequential cd commands with a loop that
derives each workspace directory and runs npm ls <package-name> inside a
subshell for that directory, preserving failures instead of redirecting stderr
to suppress them.
- Around line 354-364: Update the unresolved-advisory handling in the CVE
remediation workflow so cases where no patched version can be determined receive
a terminal Jira outcome, such as a comment, label, or manual-review transition,
before skipping the fix. Preserve the warning and do not guess a version, while
ensuring future cron polls do not retry the same unresolved ticket.
- Around line 194-218: Update the “Verification sequence” to fail closed:
require each affected workspace lockfile to change or otherwise explicitly
verify the patched resolution, and stop the remediation process on any npm
install, npm ls, or npm audit failure. Run audit checks for every affected
workspace rather than only code/, and do not suppress audit errors; report
discrepancies as failures instead of warnings.
- Around line 238-243: Clarify the Jira-comment rules in the CVE remediation
instructions so the RPM/system-level dependency path explicitly requires adding
the provided manual-intervention comment, despite the global comment
restriction. Preserve the requirement that RPM cases must not change the Jira
ticket status, and align the corresponding guidance at both referenced sections.
- Around line 33-35: Harden the package extraction and command usage in the CVE
remediation workflow: validate the Jira-derived package token against the
allowed ecosystem-specific package-name formats before using it, rejecting
invalid input. Update the affected grep, npm, Cargo, and Dockerfile commands to
pass the package through a shell variable using “--” where supported and
“"$pkg"” quoting, covering the extraction and command blocks around the
referenced sections.
- Around line 102-122: Update the “Container image system packages (RPMs)”
guidance in SKILL.md to require scanning the built image or its package
manifest/RPM database for installed packages and resolved versions. Do not use
Dockerfile searches or infer versions from Dockerfile text; compare each actual
installed RPM version against the advisory’s affected and patched ranges, while
retaining source and dependency classification where applicable.
- Around line 244-303: Update the “Step 6 — Add rebase rules” workflow to
validate every generated rebase rule before declaring remediation complete. Add
JSON syntax checks for .rebase/add and .rebase/override files, and perform a
dry-run or apply verification against the upstream tree for both JSON merges and
.rebase/replace exact text substitutions, failing when a replacement does not
match. Require these checks before commit or Jira-ticket transition.
In @.claude/skills/dependabot-cve-triage/SKILL.md:
- Line 166: Replace the concrete employee email in the JIRA_USER documentation
with a non-personal placeholder or service-account example, keeping the
description of the required Jira account email intact.
- Around line 25-28: The single-alert flow must match the all-alert flow by
requiring an open alert. Update the single-alert gh api projection to include
state, then validate that returned state is open before allowing the alert
through filtering or Jira ticket creation; reject dismissed and closed alerts.
- Line 198: Update the manifest-filtering guidance in the Dependabot CVE triage
skill to skip `.rebase/` paths and package-lock-only manifests only when the
package is not direct in the corresponding `package.json`; retain direct-package
alerts and rewrite their manifest path as required by Step 2.
- Around line 151-153: Update the remotelink curl invocation in the Jira issue
flow to stop passing JIRA_API_TOKEN through the -u command-line argument. Use a
protected temporary netrc/config or equivalent credential mechanism, ensure curl
reads it without exposing the token in argv, and remove the temporary credential
material after the request completes.
- Around line 75-79: Update the dependency scan loop to find directories
containing package.json, while preserving the existing exclusions and avoiding
duplicate directories. In the npm ls invocation, gate output on a successful
exit status rather than non-empty stdout, so only confirmed package presence is
reported.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f868067e-3a87-4651-8fcc-2f2e4742dbbd
📒 Files selected for processing (2)
.claude/skills/cve-remediation/SKILL.md.claude/skills/dependabot-cve-triage/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Around line 37-43: Update the grouped package workflow in Steps 3–8 so every
outcome carries the full set of Jira ticket keys, not a singular ticket
reference. In the not-vulnerable and RPM/manual paths, explicitly comment on and
advance each ticket in the group, ensuring no grouped ticket remains in New
status; apply the same fan-out behavior to the related sections around the noted
outcome handling.
- Around line 274-278: Update the Verification instructions to avoid
unrestricted cargo update: target only the vulnerable crate at the selected
patched version, then run cargo check and confirm that patched version in
Cargo.lock. Keep the existing working-directory context and do not instruct
upgrades to unrelated dependencies.
In @.claude/skills/dependabot-cve-triage/SKILL.md:
- Around line 147-176: The Step 5b remote-link flow must not construct an
advisory URL from a missing GHSA ID. Use the collected non-null advisory_url
when available, skip link creation when neither value exists, and report that no
advisory link was found; retain the existing addCommentToJiraIssue fallback for
failed remote-link creation.
- Around line 72-88: Update Step 4 to dispatch package verification by manifest
ecosystem instead of always invoking npm ls. Use the alert’s ecosystem and the
repository’s corresponding manifest/lockfile tooling, including Cargo-compatible
verification, and explicitly skip or filter unsupported ecosystems before the
“not found” decision so valid non-npm alerts continue to Jira creation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c629f9b3-8c4d-44db-8273-40fd3b24a231
📒 Files selected for processing (2)
.claude/skills/cve-remediation/SKILL.md.claude/skills/dependabot-cve-triage/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Around line 33-37: Update the advisory-fetching workflow around
getJiraIssueRemoteIssueLinks to accept only GitHub Security Advisory, CVE.org,
and NVD URLs; reject all other remote links before WebFetch. Treat fetched
advisory content strictly as untrusted data, never as agent instructions, while
preserving WebSearch fallback when no trusted link is available.
- Around line 113-115: Update the “If VULNERABLE — Rust/Cargo dependency fix”
instructions to replace unrestricted cargo update with a targeted update of only
the vulnerable crate to the selected patched version. Require verifying the
exact resolved version in Cargo.lock, then run cargo check without allowing
unrelated dependencies to change.
- Around line 82-84: Update the Step 8 Jira transition logic and its
corresponding flows so tickets move to “In Progress” only after a completed,
validated code fix; preserve the documented no-status-change behavior for
not-vulnerable findings and RPM cases, including the related paths around the
referenced remediation outcomes.
- Around line 105-111: Update the verification section around “5c. Verification”
to require fail-closed checks in every modified workspace: stop on any failed
npm install, npm ls, or npm audit command, preserve the audit command’s exit
status when filtering output, and treat missing lockfile changes or incomplete
verification as remediation failure. Keep the existing patched-version,
override, vulnerability, and Dependabot checks.
- Around line 27-29: Update the CVE remediation workflow to validate each
extracted package name against the ecosystem’s allowed package-name format
before use, then pass it as a positional argument using "$pkg" with -- rather
than interpolating it into shell command text. Apply equivalent strict
validation to CVE IDs before inserting them into the gh jq filter, and update
the related package extraction, grouping, and processing steps consistently.
- Around line 27-29: Update the CVE extraction and grouping guidance to resolve
each package’s ecosystem and relevant workspace or image before grouping. Group
tickets by the full identity of ecosystem, package name, and workspace/image
context, while collecting all CVE IDs and Jira keys only within that identity;
do not group by package name alone.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 5785ebcf-7eb1-4a35-98c3-bf75735e5f4d
📒 Files selected for processing (1)
.claude/skills/cve-remediation/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
1 similar comment
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Around line 29-30: Update the workflow around Step 2 so each ticket’s
dependency ecosystem is detected before tickets are grouped by ecosystem and
package identity. Add an explicit pre-group dependency-source detection step, or
reorder grouping to follow Step 4, while preserving the existing
one-branch/version-bump processing for tickets confirmed to share both
attributes.
- Around line 115-120: Update the Cargo remediation instructions around the
targeted update command to explicitly change into code/cli before running cargo
update and cargo check, since Cargo.toml is located there. Keep the
direct/transitive dependency guidance and targeted update requirement unchanged,
and verify the patched version in code/cli/Cargo.lock.
In @.claude/skills/dependabot-cve-triage/SKILL.md:
- Line 78: Update the Step 4 npm dependency check to pass the --all option to
npm ls for the target package, ensuring transitive dependencies are included
before determining the package is absent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 5c2aa680-cab6-4639-9ec5-69e6f9fbe80e
📒 Files selected for processing (2)
.claude/skills/cve-remediation/SKILL.md.claude/skills/dependabot-cve-triage/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.claude/skills/cve-remediation/SKILL.md (1)
143-147: 🗄️ Data Integrity & Integration | 🟠 MajorValidate rebase rules by applying them, not just checking presence.
A
fromstring may exist while matching zero, multiple, or the wrong upstream location. Perform a dry-run/apply verification against the upstream tree and fail on anything other than the expected exact replacement before committing the rules.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/cve-remediation/SKILL.md around lines 143 - 147, Update the rebase-rule verification instructions after `/add-rebase-rules <commit-sha>` to dry-run or apply the generated rules against the upstream tree, rather than only checking that replacement `from` text exists. Require verification to fail unless each replacement produces exactly the expected match and change, then commit the validated rules with the existing message and signoff.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Line 27: Update the CVE/package extraction flow in the remediation skill to
resolve the ecosystem first, then apply that ecosystem’s package validation;
reject option-like tokens, traversal/path-like values, malformed scoped npm
names, and shell metacharacters with a warning. Validate the extracted CVE ID
before interpolating it into the gh --jq expression, and reject invalid tickets
before any downstream command uses the values.
- Around line 115-120: Extend the Cargo CVE remediation workflow after the
targeted update and lockfile verification to audit the complete dependency tree,
using cargo tree or an equivalent audit command. Confirm every instance of the
affected package is outside the advisory range, including transitive duplicate
versions, before declaring remediation complete.
---
Outside diff comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Around line 143-147: Update the rebase-rule verification instructions after
`/add-rebase-rules <commit-sha>` to dry-run or apply the generated rules against
the upstream tree, rather than only checking that replacement `from` text
exists. Require verification to fail unless each replacement produces exactly
the expected match and change, then commit the validated rules with the existing
message and signoff.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 71da2d50-45fa-4d41-baab-3154baf5b46f
📒 Files selected for processing (2)
.claude/skills/cve-remediation/SKILL.md.claude/skills/dependabot-cve-triage/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
1 similar comment
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
|
@coderabbitai resume |
✅ Action performedReviews resumed. |
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (6)
.claude/skills/cve-remediation/SKILL.md (4)
67-67: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse npm commands that cover every installed dependency.
npm ls <package-name>omits packages outside the output selection and can hide transitive or deduplicated instances. Usenpm ls --allornpm explain --all <package-name>in each workspace so discovery and remediation check every dependency level.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/cve-remediation/SKILL.md at line 67, Update the dependency inspection step to use a command that traverses every installed dependency level in each workspace, such as npm ls --all or npm explain --all <package-name>, instead of npm ls <package-name>. Preserve the goal of identifying all affected versions and dependency chains for the target package.
79-85: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse an immutable production image reference for RPM triage.
registry.redhat.io/devspaces/code-rhel9:latestcan change without the production image tag changing, so the triage output may not match the deployed image. Use the SHA256 digest referenced by the production deployment when running the RPM checks.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/cve-remediation/SKILL.md around lines 79 - 85, Update the production-image RPM triage command in the CVE remediation guidance to use the immutable SHA256 digest referenced by the production deployment instead of the mutable registry.redhat.io/devspaces/code-rhel9:latest tag. Preserve the existing package and version checks while making the image reference match the deployed production image exactly.
87-87: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftCheck RPM reachability for every production consumer.
The RPM path only checks Node linkage from one target. If other executables or user-facing subprocesses can load the RPM, do not mark the CVE as not exploitable with “Node.js not linked against it” alone. Use advisory-specific reachability evidence for all relevant production readers.
Also applies to: 142-145.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/cve-remediation/SKILL.md at line 87, Expand the RPM reachability checks in the CVE remediation guidance beyond the Node.js binary: identify every production executable and user-facing subprocess that could load the affected library, then gather advisory-specific linkage or feature/protocol evidence for each consumer before declaring the CVE not exploitable. Update the related guidance at the referenced RPM-check section while preserving the existing Node.js checks.
52-52: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftBuild a compatible version map for every CVE.
Consolidating by highest patched version within a major line does not satisfy npm manifest constraints, Cargo ranges, or RPM package names, so it can leave some CVEs in the group unremediated. Keep each affected and patched range; select one candidate version that satisfies every manifest and fixes every CVE, or route the group to manual review.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/cve-remediation/SKILL.md at line 52, Update the “Build the consolidated version map” guidance to preserve each CVE’s affected and patched ranges rather than consolidating by the highest patch within a major line. Require selecting a candidate version compatible with every manifest constraint and fixing every CVE; if no such version exists, route the group to manual review..claude/skills/dependabot-cve-triage/SKILL.md (2)
41-41: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winValidate CVE identifiers before Jira interpolation.
Reject
cvevalues that are not^CVE-\d{4}-\d{4,}$before Step 3; onlynullis currently rejected. This value is used in JQL, labels, summary, description, andcustomfield_10667.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/dependabot-cve-triage/SKILL.md at line 41, Update the CVE validation step in the dependabot-cve-triage workflow to accept only identifiers matching ^CVE-\d{4}-\d{4,}$, rejecting null and all malformed values before Step 3. Ensure only the validated CVE identifier is used for Jira JQL, labels, summary, description, and customfield_10667 interpolation.
72-89: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy liftDo not return “package not found” solely because
npm lsfails.If this skill runs where
node_modulesis unavailable or another dependency-tree error occurs,npm ls --all <package-name>can fail even thoughpackage.jsonorpackage-lock.jsoncontains the affected package. Add fallback checks against manifests/lockfiles, or make the installed dependency-tree precondition explicit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/dependabot-cve-triage/SKILL.md around lines 72 - 89, Update Step 4’s package verification flow so a failed npm ls command is not treated as proof that the package is absent. Add fallback checks against relevant package.json and package-lock.json manifests, and only log “package not found” after those checks also find no matching package; alternatively, explicitly validate and document an installed node_modules precondition before relying on npm ls.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Line 120: Update the lockfile regeneration step in the CVE remediation
playbook to use npm install with lifecycle scripts disabled via
--ignore-scripts, while still failing if the command exits non-zero. Keep
required audit or versioning commands isolated from Jira and GitHub credentials.
- Line 124: Update the Dependabot cross-check command in Step 5 to paginate all
alert results using gh api --paginate --slurp or equivalent page/per_page
iteration, while preserving the CVE and open-state filters and manifest filename
output. Ensure any request failure terminates the step immediately instead of
allowing an incomplete check to pass.
---
Outside diff comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Line 67: Update the dependency inspection step to use a command that traverses
every installed dependency level in each workspace, such as npm ls --all or npm
explain --all <package-name>, instead of npm ls <package-name>. Preserve the
goal of identifying all affected versions and dependency chains for the target
package.
- Around line 79-85: Update the production-image RPM triage command in the CVE
remediation guidance to use the immutable SHA256 digest referenced by the
production deployment instead of the mutable
registry.redhat.io/devspaces/code-rhel9:latest tag. Preserve the existing
package and version checks while making the image reference match the deployed
production image exactly.
- Line 87: Expand the RPM reachability checks in the CVE remediation guidance
beyond the Node.js binary: identify every production executable and user-facing
subprocess that could load the affected library, then gather advisory-specific
linkage or feature/protocol evidence for each consumer before declaring the CVE
not exploitable. Update the related guidance at the referenced RPM-check section
while preserving the existing Node.js checks.
- Line 52: Update the “Build the consolidated version map” guidance to preserve
each CVE’s affected and patched ranges rather than consolidating by the highest
patch within a major line. Require selecting a candidate version compatible with
every manifest constraint and fixing every CVE; if no such version exists, route
the group to manual review.
In @.claude/skills/dependabot-cve-triage/SKILL.md:
- Line 41: Update the CVE validation step in the dependabot-cve-triage workflow
to accept only identifiers matching ^CVE-\d{4}-\d{4,}$, rejecting null and all
malformed values before Step 3. Ensure only the validated CVE identifier is used
for Jira JQL, labels, summary, description, and customfield_10667 interpolation.
- Around line 72-89: Update Step 4’s package verification flow so a failed npm
ls command is not treated as proof that the package is absent. Add fallback
checks against relevant package.json and package-lock.json manifests, and only
log “package not found” after those checks also find no matching package;
alternatively, explicitly validate and document an installed node_modules
precondition before relying on npm ls.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 1cd3d432-b6c5-4382-9a52-4cbed5bc6cb4
📒 Files selected for processing (2)
.claude/skills/cve-remediation/SKILL.md.claude/skills/dependabot-cve-triage/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
For transitive dependencies, analyze whether a newer version of the parent package pulls in a fixed transitive before falling back to overrides. Parent bumps are cleaner and more likely to align with upstream updates. Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
…nsitive deps Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add state filter for single-alert Dependabot queries - Remove personal email from JIRA_USER example - Gate npm ls on exit status instead of stdout - Ensure GHSA ID is never a placeholder during CVE grouping - Add Jira comment for unresolved advisories to prevent cron retries Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Add detailed steps for checking production image packages, verifying feature/protocol availability, and providing context-aware Jira comments based on whether the CVE actually applies. Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Add comprehensive workspace list (including launcher/ and code/test/*/), Dependabot cross-check step, EOVERRIDE warning for direct deps, and delegate rebase rule creation to /add-rebase-rules and validation to /validate-rebase-rules skills. Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Never add an npm override for a package that is already a direct dependency — the override is extraneous since npm resolves the direct dep version first. Bump the direct dep instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Reduce verbosity while preserving all decision logic: - Replace hardcoded workspace table with dynamic find command - Collapse repeated podman/bash blocks into combined examples - Merge near-identical Jira comment templates - Deduplicate override guidance and Important notes - Remove redundant cross-references between sections Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Reduce verbosity while preserving all decision logic: - Replace hardcoded workspace table with dynamic find command - Collapse repeated podman/bash blocks into combined examples - Merge near-identical Jira comment templates - Deduplicate override guidance and Important notes - Remove redundant cross-references between sections Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
cve-remediation: - Group tickets by ecosystem + package, not package name alone - Restrict advisory fetching to trusted sources (GitHub, CVE.org, NVD) - Use targeted cargo update -p instead of bare cargo update - Only transition Jira tickets that received a validated code fix dependabot-cve-triage: - Scan package.json dirs too, not just package-lock.json - Don't create advisory links from missing GHSA ID Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Use --ignore-scripts during lockfile regeneration to prevent lifecycle scripts from running arbitrary code in the automated session. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 14
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/cve-remediation/SKILL.md:
- Around line 13-15: Update the “Read-only source access by default” guardrail
in the skill instructions to state that only Steps 5–6 may modify files,
preserving the existing restriction that Steps 1–4 are read-only.
- Around line 121-126: Update the production-image inspection instructions
around the Podman command to use an immutable image digest instead of the
:latest tag, verify pull, run, and package/version query success, and fail
closed on any scan error. Remove silent error suppression and require a
successful completion signal before classifying a package as absent.
- Around line 250-252: Update the “Transition to In Progress” procedure to
present the proposed Jira transition and wait for explicit user approval before
invoking the transition API. Apply the transition only after approval, while
preserving the existing scope for completed, validated npm or Cargo fixes and
the exclusions for not-vulnerable, RPM, and unresolved-advisory tickets.
- Around line 19-24: Update the explicit Jira-key path in the CVE remediation
workflow to validate the ticket before any Jira writes or code changes: require
project membership, filter 112309 membership, component devspaces/code-rhel9, an
allowed issue type, and the expected summary format, while retaining the
existing New/To Do status and ai-cve-triaged checks. Reject tickets failing any
scope validation and process only those that satisfy all requirements.
- Around line 111-115: Update the Rust/Cargo dependency guidance in section “4b.
Rust/Cargo dependencies” to replace the grep-based lookup with structured
dependency inspection using cargo tree -i, cargo metadata, or a Cargo.lock
parser. Ensure the remediation reports the resolved package version and
identifies whether the dependency is direct or transitive.
- Around line 60-90: Update the external CVE enrichment and cross-validation
flow in “External CVE data enrichment” to filter MITRE and OSV records against
the identified CVE group target package, matching product, repository, package,
and ecosystem where applicable before accepting any fixed version or threshold.
Do not treat unrelated affected ranges as authoritative; present unresolved
target mismatches to the user, while retaining Jira fallback behavior when no
matching external record is available.
- Around line 102-109: Update the workspace dependency-discovery instructions
around the npm ls guidance to avoid treating non-zero npm ls results as evidence
that a package is absent. Require checking each workspace’s package.json and
lockfile for the package and version, or using an isolated no-install/no-script
inspection approach, while retaining dependency-chain analysis where npm ls
succeeds.
- Around line 199-203: Update the Cargo verification instructions around the
targeted cargo update and cargo check commands to run in an isolated environment
without Jira or GitHub agent credentials, ensuring those credentials are
unavailable to dependency build scripts and procedural macros while preserving
the targeted update and lockfile verification steps.
- Around line 197-203: Update the Rust/Cargo remediation instructions to require
validating package names and patched versions before shell use, rejecting shell
metacharacters and accepting only valid ecosystem package identifiers and
SemVer, tags, or lockfile-resolved versions. Require passing validated values as
separate arguments or safely shell-quoting them in targeted cargo commands, and
apply the same validation and quoting requirements to npm override ranges used
later.
- Around line 189-195: Update the Dependabot query in the cross-check step to
filter alerts by the validated CVE ID plus the affected dependency package name
and ecosystem before extracting dependency.manifest_filename. Preserve
pagination, failure-on-request-error behavior, open-alert filtering, and unique
manifest output.
- Around line 183-188: Update the Verification instructions around the npm
install step to require reviewing each regenerated lockfile diff and rejecting
unrelated dependency resolutions or metadata changes. Stop remediation if such
changes appear, while retaining the existing checks for lockfile updates and
override application.
In @.claude/skills/dependabot-cve-triage/SKILL.md:
- Around line 107-111: Update the Step 5a CVE group template to conditionally
include the GHSA and advisory fields only when their values are available,
rather than emitting the literal placeholders <GHSA-ID> or <advisory-url>.
Preserve the existing CVE, package, severity, and available-field formatting.
- Line 40: Update the manifest normalization and filtering logic described in
the skill so package-lock.json alerts are retained only when the package is a
direct dependency in the corresponding package.json; skip transitive packages
after performing that check instead of preserving the original lockfile manifest
path. Apply this consistently at both the normalization guidance and the
corresponding later rule.
- Around line 78-80: Update the dependency search in the find loop to detect
package-lock.json in each manifest directory and use lockfile-backed `npm ls
--all --package-lock-only <package-name>` when present, so clean checkouts
without node_modules are included; retain the existing installed-tree check for
directories without a lockfile.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: b0c6f286-5c67-4cf9-a065-13efcdfc7052
📒 Files selected for processing (2)
.claude/skills/cve-remediation/SKILL.md.claude/skills/dependabot-cve-triage/SKILL.md
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
@coderabbitai review |
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
1 similar comment
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-756-amd64 |
2 participants
What does this PR do?
this PR introduce two skills.
Needs JIRA MCP correclty configured and github access to security panel
What issues does this PR fix?
https://redhat.atlassian.net/browse/CRW-11156
How to test this PR?
Does this PR contain changes that override default upstream Code-OSS behavior?
git rebasewere added to the .rebase folderSummary by CodeRabbit