/cve-check and /cve-check-and-upgrade #3

2026-08-11T19:03:38Z

autonomic-bot commented

2026-08-11 19:03:38 +00:00

Two new skills plus the reconcile rule they exposed.

/cve-check — fleet-wide CVE sweep with no upgrading: resolve each recipe's available window per image, scan, adjudicate, publish a report. Read-only.
/cve-check-and-upgrade — the same sweep, then PRs only for recipes whose upgrade actually closes a CVE, worst severity first. Never merges.
recipe-report.py grows a cve page kind so a sweep cannot overwrite a weekly edition, while both appear in one archive.
reconcile made mandatory in /cve-check, with the trap that produced a false finding written down: several coopcloud recipes keep a stale main beside the real default master.

Retrospective review PR. These commits were pushed straight to main during the 2026-08-11 session; they are already live. This PR exists so the work is reviewable and commentable as a unit — its base is a branch pinned at the pre-session commit, so merging it simply advances that pointer and changes nothing on main. Going forward, orchestrator changes go through a PR before landing.

Two new skills plus the reconcile rule they exposed. - **`/cve-check`** — fleet-wide CVE sweep with no upgrading: resolve each recipe's available window per image, scan, adjudicate, publish a report. Read-only. - **`/cve-check-and-upgrade`** — the same sweep, then PRs only for recipes whose upgrade actually closes a CVE, worst severity first. Never merges. - **`recipe-report.py`** grows a `cve` page kind so a sweep cannot overwrite a weekly edition, while both appear in one archive. - **reconcile made mandatory in `/cve-check`**, with the trap that produced a false finding written down: several coopcloud recipes keep a stale `main` beside the real default `master`. --- *Retrospective review PR.* These commits were pushed straight to `main` during the 2026-08-11 session; they are already live. This PR exists so the work is reviewable and commentable as a unit — its base is a branch pinned at the pre-session commit, so merging it simply advances that pointer and changes nothing on `main`. Going forward, orchestrator changes go through a PR before landing.

autonomic-bot added 3 commits 2026-08-11 19:03:39 +00:00

add /cve-check and /cve-check-and-upgrade b0bdce2c15

/cve-check answers 'what are we exposed to that an upgrade would fix?' without
running an upgrade: per-recipe, resolve the available window for EVERY image
(sidecars included), run the advisory scan over it, adjudicate whatever pass 1
could not decide, publish a report. Read-only — no PRs, no CI, no merges.

/cve-check-and-upgrade does that sweep, then runs /recipe-upgrade only on the
recipes whose upgrade actually closes a CVE, worst severity first, and reports
on both. --min-severity high for just the urgent ones; --dry-run prints the
queue and stops. Never merges.

Deliberate choices, each written into the skills:
- externals are SWEPT but never upgraded here — a security sweep that skipped
  deployed software would misreport exposure, but we don't maintain them.
- an unknown count never justifies an upgrade AND is never treated as clean;
  it goes to the Addendum.
- no upgrade available means 0 CVEs, not '?'.
- subagents are told which CVEs justify their upgrade, so the PR says why it
  exists — a PR naming the RCE it closes gets reviewed sooner.

recipe-report.py grows a page kind: 'cve' files as cve-DATE.html so a sweep
can't overwrite a weekly edition, while BOTH appear in the same archive index,
suffixed 'full report' / 'CVE check'.

/help and /cc-ci-status updated to route to them.

advisory-scan: two more cases decided in pass 1, found by the first real /cve-check 18caf047bf

1. Release-note resolution now covers vendor pages on the same repo. It required
   a github-advisories: source, so mailu's Roundcube CVEs — announced only on
   github.com/Mailu/Mailu/releases — went to pass 2 even though the answer was
   sitting in the release notes. mailu now reports 2 deterministically, matching
   what previously took an agent reading the notes.

2. 'All known fix versions predate the version we were on' is now a DECISION,
   not an unknown. mailu's redis 8.8.0 -> 8.10.0 crosses 12 advisories all fixed
   by 8.6.3 or earlier; reporting them as 'could not judge' overstated the
   uncertainty. Recorded as outside-window with the naming tags as evidence.
   A fix landing ABOVE the window still stays indeterminate on purpose: that is
   an open vulnerability and must stay visible.

60 offline tests (was 58). discourse 140 / gitea 2 unchanged.

cve-check: reconcile is mandatory; do not assume the default branch is main 8df32edfcf

Skipping the reconcile to keep the sweep 'read-only' was wrong. It researches a
stale checkout, and on the first real run left two recipes with no survey output
at all — indistinguishable from 'no upgrades available' unless you look. The
reconcile is safe precisely because recipe work lives in branches, not on main.

Also documents the trap that produced a false finding in that run: several
coopcloud recipes keep a stale 'main' beside the real default 'master'. gitea's
main is at 1.24.2-rootless while master has 1.27.1-rootless and the merged PRs,
so reading main reports a recipe three releases behind and missing two CVSS-9.8
RCE fixes. Resolve default_branch from the API before reading any file.

And: no output is not 'no upgrade'. It is a third outcome, and only becomes '?'
after the direct registry check has also failed.

autonomic-bot merged commit 10840263aa into review/1-cve-engine

2026-08-11 19:03:53 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#3