fix(dashboard): parse managed-repos.yaml as real YAML, not regex - #79
Merged
Conversation
getManagedRepos() used `/^\s*-\s+(.+)$/` which, against the actual
`repos: [{owner, name, policies}]` schema, captured `owner: ry-ops` off
every entry — collapsing all 43 managed repos to one bogus name. The
dashboard scan then queried garbage repo names, every request errored,
and it reported 0 open alerts across the whole fleet (fixRate 1.0). The
new status.json inherited the same false "fleet is clean" picture while
simultaneously listing hard-stopped repos — the contradiction that
surfaced this bug.
Parse with the `yaml` package (already a dep) and map owner/name pairs,
mirroring the #77 fix to heartbeat.yml. Tolerates a legacy flat
`- owner/name` list too. Verified: now yields 43 unique repos incl.
ry-ops/DriveIQ instead of 1 malformed entry.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug (fleet-wide observability failure)
ci-dashboard.mjsgetManagedRepos()parsedconfig/managed-repos.yamlwith/^\s*-\s+(.+)$/. The file's actual schema is:So the regex captured
owner: ry-opsoff every entry, collapsing all 43 managed repos to a single bogus name. The scan then queried garbage repo names, every request errored, and the dashboard reported 0 open alerts across the entire fleet →fixRate: 1.0.This is the same class of bug #77 fixed in
heartbeat.yml— butci-dashboard.mjswas never updated. It silently made the public dashboard (and the newstatus.json) report a falsely-clean fleet, masking real CVE backlog on every repo.Surfaced by
The
status.jsonemitter (PR #78) reportedtotalOpenAlerts: 0/fixRate: 1.0while simultaneously listing 4 repos inescalation.hardStop(incl. DriveIQ, which has 71 open Dependabot alerts). The escalation list comes from persisted state and is real; the scan was blind.Fix
Parse with the
yamlpackage (already a direct dep,^2.3.0) and mapowner/namepairs. Tolerates a legacy flat- owner/namelist for safety.Verified: now yields 43 unique repos including
ry-ops/DriveIQ(was 1 malformed entry).🤖 Generated with Claude Code