micro--go-micro
Asim Aslam
bba3b8ba98
Adds a deterministic reachable-CVE gate: `govulncheck ./...` on every push/PR, failing on any reachable vulnerability EXCEPT an explicit allow-list of known-unfixable ones. Today the allow-list holds exactly the two pgx/v4 CVEs (GO-2026-5004, GO-2026-4518) with no upstream fix (tracked in #4556), so the gate is green now and turns red the moment a NEW vulnerability appears. This is the deterministic layer under the `security` loop role: the role audits with judgment, this blocks known CVEs mechanically. Also adds `govulncheck` to the loop-triage watch list, so a newly-disclosed CVE that reddens the gate on master auto-files a fix issue for the loop to bump the dep. Make `govulncheck` a required status check on master to enforce it. Verified locally: exit 3 with only the two allow-listed IDs -> gate PASS. Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL Co-authored-by: Claude <noreply@anthropic.com>
58 行
2.3 KiB
YAML
58 行
2.3 KiB
YAML
name: "Loop: Triage"
|
|
|
|
# Generated by `micro loop init`. The feedback path of the evaluator: when a CI
|
|
# workflow (Harness (E2E), Lint, Run Tests) fails on a non-PR run, dispatch the agent
|
|
# (@codex) with the instruction in .github/loop/prompts/triage.md
|
|
# to root-cause the failure and file scoped fix issues back into the queue — so
|
|
# failures become fixes with no human in the middle. Gated on CODEX_TRIGGER_TOKEN.
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["Harness (E2E)", "Lint", "Run Tests", "govulncheck"]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
issues: write
|
|
|
|
concurrency:
|
|
group: loop-triage
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
triage:
|
|
# Only real failures on branch pushes/schedules — not PR-run failures, which
|
|
# the PR author already sees.
|
|
if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'pull_request' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4 # needed to read the prompt file
|
|
- name: Dispatch triage
|
|
env:
|
|
GH_TOKEN: ${{ secrets.CODEX_TRIGGER_TOKEN || github.token }}
|
|
HAS_TOKEN: ${{ secrets.CODEX_TRIGGER_TOKEN != '' }}
|
|
REPO: ${{ github.repository }}
|
|
RUN_ID: ${{ github.event.workflow_run.id }}
|
|
RUN_URL: ${{ github.event.workflow_run.html_url }}
|
|
WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
|
|
run: |
|
|
if [ "$HAS_TOKEN" != "true" ]; then
|
|
echo "CODEX_TRIGGER_TOKEN is not set — skipping."
|
|
exit 0
|
|
fi
|
|
PROMPT=".github/loop/prompts/triage.md"
|
|
if [ ! -f "$PROMPT" ]; then
|
|
echo "missing $PROMPT — run 'micro loop init'." >&2
|
|
exit 1
|
|
fi
|
|
ISSUE_URL=$(gh issue create --repo "$REPO" \
|
|
--title "Loop: triage failed run $RUN_ID ($WORKFLOW_NAME)" \
|
|
--body "The '$WORKFLOW_NAME' workflow failed on a non-PR run: $RUN_URL")
|
|
ISSUE_NUM="${ISSUE_URL##*/}"
|
|
echo "Opened issue #$ISSUE_NUM — dispatching triage."
|
|
{
|
|
echo "@codex"
|
|
echo
|
|
sed -e '/<!--/,/-->/d' -e "s/__ISSUE__/$ISSUE_NUM/g" -e "s#__RUNURL__#$RUN_URL#g" "$PROMPT"
|
|
} > "$RUNNER_TEMP/loop-body.md"
|
|
gh issue comment "$ISSUE_NUM" --repo "$REPO" --body-file "$RUNNER_TEMP/loop-body.md"
|