From 318d09bdab2f0c0364da4c9587ebfcaf89c967e4 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 10 Aug 2026 20:23:10 +0000 Subject: [PATCH] =?UTF-8?q?advisory-scan:=20eliminate=20spurious=20'=3F'?= =?UTF-8?q?=20=E2=80=94=20url=20punctuation,=20stale=20URL,=20and=20=3F=20?= =?UTF-8?q?semantics?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2026-08-07 regeneration rendered '?' for 5 of 21 recipes. '?' is meant to be a rare 'we tried and could not tell'; at that rate it is indistinguishable from noise and hides the real unknowns. Three causes, none of them genuine uncertainty: 1. URL EXTRACTION BUG (mine). The registry is markdown, so urls appear inside `backticks` and 'quotes'. The extractor captured the trailing punctuation, so it fetched https://docs.n8n.io/release-notes/` and https://git.autonomic.zone'` — both 404 on the malformed url, both 200 when clean. Trailing markdown punctuation is now stripped. Fixed immich + n8n. 2. STALE REGISTRY URL. mattermost-lts pointed at docs.mattermost.com/about/mattermost-changelog.html, which 404s; the page moved to /deploy/. Corrected (same class as the pgautoupgrade fix). 3. WRONG SEMANTICS FOR 'NO UPGRADE'. lasuite-docs and custom-html-tiny were up-to-date this run, so no scan block existed and the report fell back to '?'. But a recipe with no upgrade has nothing an upgrade could have fixed — that is 0, not unknown. The report skill now says so explicitly, restricts '?' to scans that RAN and reported genuinely failed sources, states that benign notes (no-advisories-published / template URL) never trigger '?', and instructs that many '?' is itself a bug to raise in the Addendum. Result across all 16 scanned recipes of that run: 0 failed sources (was 5). Counts also improved with the classifier fix: discourse 130->133, keycloak ->7. --- .claude/skills/recipe-report/SKILL.md | 15 +++++++++++---- cc-ci-plan/advisory-scan.py | 8 ++++++-- cc-ci-plan/upstream/mattermost-lts.md | 2 +- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/.claude/skills/recipe-report/SKILL.md b/.claude/skills/recipe-report/SKILL.md index da02aa7..2075c8d 100644 --- a/.claude/skills/recipe-report/SKILL.md +++ b/.claude/skills/recipe-report/SKILL.md @@ -42,10 +42,17 @@ keeps every weekly edition looking the same regardless of which model writes the Advisories + vendor security pages + OSV, with severities and fixed-in versions). Treat its CVE list as a **further source** and report the **UNION** of it and what you found by reading. Its entries are machine-derived with advisory IDs, so prefer them for CVE ids / severities / - fixed-in versions, and cite the GHSA where present in the Security Bulletin. If a recipe has - no scan block, or the block lists **failed sources**, the count is **not** authoritative: - render the cve cell as `?` (unknown), never `none` — a blank that reads as "clean" is exactly - how two CVSS-9.8 gitea RCEs were reported as "none" on 2026-08-07. + fixed-in versions, and cite the GHSA where present in the Security Bulletin. If the block + lists **failed sources**, the count is **not** authoritative: render the cve cell as `?` + (unknown), never `none` — a blank that reads as "clean" is exactly how two CVSS-9.8 gitea + RCEs were reported as "none" on 2026-08-07. + - **`?` must stay RARE — it means "we tried and could not tell", not "we didn't look".** Use it + ONLY when a scan ran and reported genuinely failed sources. In particular: a recipe with **no + upgrade this run** (up-to-date/skipped) has nothing an upgrade could have fixed — report `0`, + not `?`. A recipe with a clean scan reports its number (including `0`). Benign notes in a scan + block (`no-advisories-published`, `skipped: template URL`) are NOT failures and must not + trigger `?`. If you find yourself rendering `?` for many recipes, that is a bug to report in + the Addendum, not a normal outcome. Anything **critical/high** also gets a `security` bulletin entry (recipe · CVE id(s) + severity · what it fixes · PR link); be specific about severity and what's exposed if not merged. - **Lead — ONE short paragraph.** A tight, concrete opener in opus's voice: fleet state in a sentence diff --git a/cc-ci-plan/advisory-scan.py b/cc-ci-plan/advisory-scan.py index 61994b0..01cccd3 100755 --- a/cc-ci-plan/advisory-scan.py +++ b/cc-ci-plan/advisory-scan.py @@ -114,8 +114,12 @@ def registry_urls(recipe: str, registry_dir: str) -> tuple[list[str], str | None return [], None urls = [] for u in re.findall(r"https?://[^\s)|\]]+", text): - u = u.rstrip(".,;") - if u not in urls: + # The registry is MARKDOWN: urls appear inside `backticks`, 'quotes', **bold**, and at the + # end of sentences. Trailing punctuation captured into the url makes the fetch 404 and the + # recipe render '?' for no real reason — that is what put immich and n8n in the unknown + # column on 2026-08-07 (https://docs.n8n.io/release-notes/` ← note the backtick). + u = u.rstrip("`'\"*.,;:>)") + if u and u not in urls: urls.append(u) return urls, path diff --git a/cc-ci-plan/upstream/mattermost-lts.md b/cc-ci-plan/upstream/mattermost-lts.md index 5677605..ec90ccd 100644 --- a/cc-ci-plan/upstream/mattermost-lts.md +++ b/cc-ci-plan/upstream/mattermost-lts.md @@ -2,7 +2,7 @@ | service | image | source repo | releases / changelog | |----------|-------------------------------------------|---------------------------------------------------|-------------------------------------------------------------------| -| app | mattermost/mattermost-team-edition | https://github.com/mattermost/mattermost | https://docs.mattermost.com/about/mattermost-changelog.html | +| app | mattermost/mattermost-team-edition | https://github.com/mattermost/mattermost | https://docs.mattermost.com/deploy/mattermost-changelog.html | | postgres | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ | ## Standing notes