recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve recipe advisory coverage and report non-CVE fixes

Browse Source
This commit is contained in:
notplants
2026-11-02 19:40:46 +00:00
committed by notplants
parent 508d6bb0de
commit bd7196bf9e
7 changed files with 238 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/skills/cve-check/SKILL.md
+5 -4
View File
@@ -113,9 +113,9 @@ A recipe whose sources yield **no CVE data at all** cannot produce a meaningful
measured, the same way a missing registry file cannot. Render those as **`?`**, not `0`.
Do not assume that the fleet has zero blind recipes. Run the audit every sweep and inspect source
statuses; an HTTP error or rate limit is not evidence of no CVEs. `rustdesk-server` is currently
blind because its upstream GitHub repo publishes no security advisories and no other usable source
has been verified; mark it `?` until that changes.
statuses; an HTTP error or rate limit is not evidence of no CVEs. `rustdesk-server` has an NVD CPE
scoped to the OSS server edition; a successful zero-result query is a checked zero for that source,
not a reason to count Client or Server Pro vulnerabilities against it.
Check `test -s /srv/cc-ci/.github-token` before a fleet scan. Without that read-only token,
GitHub's anonymous API limit can be exhausted partway through the fleet; HTTP 403 results are
@@ -178,7 +178,8 @@ Severity outranks raw count: 2 CVSS-9.8 RCEs matter more than 120 medium plugin
- `table[]` — every recipe swept. `recipe`; `change` = the window you scanned, e.g.
`1.27.0 → 1.27.1 · redis 7.4 → 8.10`; `status` = `UPTODATE` when nothing is available, else
`PENDING` (an upgrade exists and is not yet taken); **`cve`** = the count (integer, `?` only per the
rules below); `notes` = severity mix, whether the number is a floor, and `maintained elsewhere` for
rules below, or `"YES"` when a confirmed security advisory has no CVE ID and no numbered CVEs
were found); `notes` = the advisory ID and severity, whether the number is a floor, and `maintained elsewhere` for
`external` rows. **Leave `ci`/`pr` empty — nothing was built and no PR exists.**
- `addendum[]` — real anomalies only: registry URLs that failed, recipes whose window could not be
established, a scan whose count is a floor with many undetermined advisories.