From 8df32edfcf6d7a679ef3e44ecf5eda47626ded6a Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Tue, 11 Aug 2026 04:32:49 +0000 Subject: [PATCH] cve-check: reconcile is mandatory; do not assume the default branch is main MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Skipping the reconcile to keep the sweep 'read-only' was wrong. It researches a stale checkout, and on the first real run left two recipes with no survey output at all — indistinguishable from 'no upgrades available' unless you look. The reconcile is safe precisely because recipe work lives in branches, not on main. Also documents the trap that produced a false finding in that run: several coopcloud recipes keep a stale 'main' beside the real default 'master'. gitea's main is at 1.24.2-rootless while master has 1.27.1-rootless and the merged PRs, so reading main reports a recipe three releases behind and missing two CVSS-9.8 RCE fixes. Resolve default_branch from the API before reading any file. And: no output is not 'no upgrade'. It is a third outcome, and only becomes '?' after the direct registry check has also failed. --- .claude/skills/cve-check/SKILL.md | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/.claude/skills/cve-check/SKILL.md b/.claude/skills/cve-check/SKILL.md index 47a803f..8f2d683 100644 --- a/.claude/skills/cve-check/SKILL.md +++ b/.claude/skills/cve-check/SKILL.md @@ -51,9 +51,22 @@ This is `/recipe-upgrade` step 1's research, stopping before it implements anyth > registry directly for the ones abra could not read, picking the newest tag the app version > supports rather than the numerically highest. -Reconcile the mirror from true upstream first (so you research the real current recipe, not a stale -mirror), then read versions — **note this is the same reconcile `/upgrade-all` does, and it is -read-only with respect to the recipe's content**: +**Reconcile the mirror from true upstream FIRST — ALWAYS, no exceptions.** This is the same reconcile +`/upgrade-all` does. Do not skip it in the name of keeping the sweep read-only: skipping it makes you +research a stale checkout, and on the first real run that produced **two recipes with no survey output +at all**, which is indistinguishable from "no upgrades" unless you check. It is safe — recipe work +lives in **branches**, never directly on `main`, so a force-sync of `main` to upstream discards +nothing; it also auto-closes mirror PRs whose changes upstream has already merged. + +> ### ⚠️ The default branch may be `master`, not `main` — check, do not assume +> Several coopcloud recipes keep a **stale `main` alongside the real default `master`**. gitea is one: +> `main` sits at 1.24.2-rootless while `master` has 1.27.1-rootless plus the merged PRs and the 3.6.3 +> release. Reading `main` there tells you the recipe is three releases behind and missing two CVSS-9.8 +> RCE fixes — a false alarm that reads exactly like a real one. Resolve the default branch from the +> API (`/api/v1/repos/coop-cloud/` → `default_branch`) before reading any file, and never +> `git reset --hard origin/main` on a checkout that tracks `master`. + +Then read versions: ``` set -a; . /srv/cc-ci/.testenv; set +a ssh cc-ci "GITEA_USERNAME='$GITEA_USERNAME' GITEA_PASSWORD='$GITEA_PASSWORD' GITEA_URL='$GITEA_URL' bash -s --reconcile-only" \ @@ -71,6 +84,12 @@ CRITICAL came from, and an image with no window is not counted at all. - **No upgrade available** → the recipe is `UPTODATE`; its CVE count is **`0`**, not `?`. There is nothing an upgrade could fix. Record it and move on. +- **No output at all is NOT "no upgrade".** An abra call that times out, FATAs, or prints nothing + leaves the recipe **unverified** — treat it as a distinct outcome, never fold it into up-to-date. + Re-run it, and if it still yields nothing, resolve the versions by direct registry check (box item 4). + Only report `?` once BOTH the abra check and the direct check have failed. On the first real run this + distinction was the difference between two false zeros and the truth (both recipes turned out fine, + but nothing in the survey said so). ### 3. Run the advisory scan over that window ```