Prevent duplicate Child Issues and incorrect Parent closures in AquaSec dry-runs

Aperta
  • Qualcosa non va?
#145 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@tmikula-dev ci sta già lavorando.

Dal 10/11/2026.

  • #146 di @tmikula-dev — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

bug

Describe the bug

  1. Repeated equivalent Findings can create multiple Child Issues for the same Finding Identity.
  2. Dry-run Parent closure checks ignore newly simulated Children, incorrectly reporting active Parents as resolved.
1. Repeated Findings create duplicate Children

The parser creates one Alert for every AquaSec row, including equivalent rows sharing the same Finding Identity and Result Hash.

Matching is resolved for the entire scan before any issues are created. Repeated Alerts therefore remain independently unmatched, and each creates a Child Issue. Registering the first newly created Child does not update those precomputed matches.

This violates the intended policy of one Child Issue per distinct Finding Identity. Repeated unchanged scans can also close duplicate owners and create replacements, causing unnecessary issue churn.

2. Dry-run incorrectly closes Parents with active Children

Newly simulated Children are registered in the Issue Index, but not in the numbered issue collection. Parent closure checks enumerate the numbered collection, so they cannot see these simulated Children.

When old Children close and replacements are simulated, the dry-run can incorrectly report that their Parent has no open Children.

The dry-run creation path also needs to mirror Parent reopening when a new Child belongs to an existing closed Parent.

Expected state

Duplicate handling
  • Equivalent repeated Findings become one Alert before Matching.
  • Identical duplicates are skipped and processing continues normally.
  • Differences in unused fields, such as vendor scoring, do not create additional Children.
  • Distinct SAST occurrences remain separate.
  • Conflicting parsed data sharing an identifier must not be silently treated as an identical duplicate.
  • The raw scan artifact remains unchanged.
  • Repeating unchanged scan data does not create or close duplicate Children.
Parent lifecycle
  • Parent closure checks consider all known Children, including newly simulated Children.
  • Creating a simulated Child keeps its Parent open or reopens it when necessary.
  • A Parent closes when its known Children are genuinely all closed.
  • Multiple simulated Children remain distinct despite sharing placeholder issue number 0.
Acceptance criteria
  • Normalize equivalent duplicate Findings before whole-scan Matching.
  • Preserve the existing single-claim Matching and SAST ownership safeguards.
  • Use the complete Child collection for Parent closure decisions.
  • Mirror Parent reopening and closure state changes during dry-run.
  • Add regression coverage for repeated input across two synchronization passes.
  • Add regression coverage for replacement Children, closed Parents, and genuinely resolved Parents.
  • Preserve the counting policy documented in #130.

Impact / Severity

High

The first defect can create persistent duplicate issues and inflate notifications. The second makes the dry-run unreliable as a safety check before enabling writes.

Attachments / Evidence

Observed workflow

https://github.com/absa-group/AUL/actions/runs/42626812554

Configuration:

  • Dry-run enabled.
  • Minimum Severity: high.
  • Artifact: aquasec-night-scan, containing aquasec_scan.json.
  • The supplied downloaded JSON was confirmed to match the run artifact.
Count reconciliation

The artifact contains 304 rows across all severities. Its high/critical subset is:

Finding Category AquaSec rows Distinct Finding Identities
SAST 27 27
Vulnerabilities 154 102
Pipeline Misconfigurations 2 2
Total 183 131

The dry-run proposes 183 Child creations. Under the existing distinct-Finding-Identity policy, 52 of those are unnecessary duplicates.

Concrete duplicate example

The following Finding appears three times with every exported field identical:

Field Value
Rule CVE-2026-54512
File pom.xml
Package com.fasterxml.jackson.core:jackson-databind
Installed version 2.15.0
Result Hash 0cbe6a006f64056416d7b6acd3365522

The original run contains three corresponding creation proposals:

Security [DRY-RUN] - Would create child issue for alert FP=0cbe6a00 (rule: CVE-2026-54512, severity: high)
Security [DRY-RUN] - Would create child issue for alert FP=0cbe6a00 (rule: CVE-2026-54512, severity: high)
Security [DRY-RUN] - Would create child issue for alert FP=0cbe6a00 (rule: CVE-2026-54512, severity: high)

These are duplicate creation proposals, not evidence that this dry-run actually created GitHub issues.

Incorrect Parent closure evidence

The run proposes 112 Parent closures. Of these, 34 Parents have high/critical Findings in the same artifact and newly simulated Children for their Rules.

Examples:

  • absa/ABC#6259: CVE-2026-111752.
  • absa/ABC#4368: insecure-disable-cert-verification-aquasec-python.

Those Parents must not be closed merely because simulated Children are absent from the numbered issue collection.

Desktop

  • Environment: GitHub Actions.
  • Runner: ubuntu-latest.
  • Python: 3.14.
  • Browser: not applicable.

Related / References

Lingua principale
Python
Stelle
0
Fork
0
Merge medio
1g 5h
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di AbsaOSS/organizational-workflows

Tutte le issue di AbsaOSS/organizational-workflows

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.