chore: automate CVE remediation - #1538
Conversation
This comment has been minimized.
This comment has been minimized.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughThe change adds scheduled and manual CVE remediation workflows. It discovers unlinked CVE issues from Linear, filters and prioritizes them, and conditionally starts a constrained Claude remediation job. CI tests validate discovery and workflow configuration. ChangesCVE remediation automation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Scheduler
participant DiscoveryJob
participant Linear
participant Claude
participant Repository
Scheduler->>DiscoveryJob: Start scheduled or manual workflow
DiscoveryJob->>Linear: Query paginated open CVE issues
Linear-->>DiscoveryJob: Return issue data and cursors
DiscoveryJob->>Claude: Start remediation when issues exist
Claude->>Linear: Read issue data through read-only MCP
Claude->>Repository: Update dependencies, verify changes, and open pull requests
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/_cve-remediation.yml:
- Around line 34-35: Update the checkout configuration in the reusable CVE
remediation workflow to use the available github.repository and github.sha
contexts instead of job.workflow_repository and job.workflow_sha. Preserve
same-repository caller behavior; only introduce explicit workflow inputs if
cross-repository reuse must be supported.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: d63f2d8d-14f9-41b6-b0ff-fcd0fb44a629
📒 Files selected for processing (7)
.github/prompts/cve-remediation-system.md.github/scripts/filter-unlinked-cve-issues.jq.github/scripts/find-unlinked-cve-issues.sh.github/scripts/test-cve-remediation.sh.github/workflows/_cve-remediation.yml.github/workflows/cve-remediation.yml.github/workflows/test.yml
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit dcafc5a. Configure here.
| --max-turns 80 | ||
| --tools "Bash,Read,Edit,Write,Glob,Grep" | ||
| --allowedTools "Read,Edit,Write,Glob,Grep,Bash(git *),Bash(gh pr *),Bash(yarn *),Bash(npm *),Bash(npx *),Bash(pnpm *),Bash(bun *),Bash(go *),Bash(cargo *),Bash(uv *),Bash(pytest *),Bash(python -m pytest *),Bash(make *),Bash(just *),mcp__linear__get_issue,mcp__linear__list_comments" | ||
| --disallowedTools "Bash(gh pr merge *),Bash(git push *--force*),Bash(npm publish *),Bash(yarn npm publish *),Bash(pnpm publish *),Bash(cargo publish *)" |
There was a problem hiding this comment.
Force-push short flag still allowed
Medium Severity
disallowedTools blocks git push only when the command contains --force, while allowedTools permits all git commands under dontAsk. The common short form git push -f therefore stays auto-approved for this unattended agent, so the force-push safeguard does not cover the usual destructive path.
Reviewed by Cursor Bugbot for commit dcafc5a. Configure here.
1 participant
Summary
Testing
.github/scripts/test-vulnerability-triage.sh.github/scripts/test-cve-remediation.shactionlintRefs SOU-1830
Note
Medium Risk
The remediate job grants contents/PR write and runs an unattended agent with broad Bash and PR tooling; safeguards (read-only Linear MCP, disallowed merge/publish) reduce risk but automated dependency changes still need review.
Overview
Adds automated CVE remediation on top of existing vulnerability triage: open Linear CVEs for the repo that still lack a linked GitHub PR are discovered deterministically, then a Claude agent runs only when that list is non-empty.
Discovery paginates Linear (shared
linear-graphql-request.sh), filters withfilter-unlinked-cve-issues.jq(CVE label, nogithub.com/.../pull/...attachment, priority sort), and caps issues viamax_issues. A reusable workflow (_cve-remediation.yml) runs discovery first and gates the remediate job onhas_issues.Remediation uses
anthropics/claude-code-actionwith a checked-in system prompt (cve-remediation-system.md), read-only Linear MCP (--strict-mcp-config), and allow/disallow lists for git,gh pr, package managers, and tests—without merge, force-push, or publish.A nightly workflow (
cve-remediation.yml, schedule +workflow_dispatch) calls the reusable workflow with repo concurrency. CI expands the vulnerability job tovulnerability-automationand runstest-cve-remediation.shalongside existing triage tests.Reviewed by Cursor Bugbot for commit dcafc5a. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by CodeRabbit
New Features
Tests