Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Nightly security sweep: turn Dependabot and code-scanning (CodeQL) alerts into board-tracked issues

Đang mở
  • Có gì không ổn?
#2,542 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github, github-actions, javascript
Lĩnh vực
ci-cd, devops, security

Hướng nghiên cứu

Start with scripts/dependabot-alerts.mjs, dependabot-alerts.yml, and the relevant rules in AGENTS.md; compare the existing Dependabot sweep with the CodeQL API and workflow permissions described here. Check the credential dependency in #2544 and the v2/main scanning split in #2545 before implementation. Done means nightly, deduplicated Dependabot and code-scanning findings are filed and boarded, while malformed listings write nothing.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

blocked chore v2

Problem

Security alerts reach this repo from two GitHub sources, and only one of them becomes tracked work:

Source What produces it Swept into issues today?
Dependabot alerts vulnerable dependency ranges in a lockfile Yes, daily (dependabot-alerts.yml, #2233). It files issues, but cannot board them: PROJECT_TOKEN does not exist (#2462).
Code scanning alerts CodeQL (default setup), plus any other tool that uploads SARIF No. Nothing reads them.

CodeQL is not a third source: it is the tool behind the code-scanning alerts on Security → Code scanning. A sweep reads them all through one API, GET /repos/{owner}/{repo}/code-scanning/alerts, and can split by tool.name.

What that gap cost during the v2.9.0 release:

  • A high-severity ReDoS reached the release PR undetected. CodeQL flagged clients/cli/src/error-handler.ts:169 only as a check on the milestone-merge PR (#2536). It was a regression from this milestone's #2423 work, fixed in #2540 / #2541, with the release on hold meanwhile.
  • Three high-severity alerts sit open with no issue: #74, #75, #76, all js/incomplete-sanitization ("does not escape backslash characters"), in scripts/dependabot-alerts.mjs:435, :679 and scripts/sdk-watch.mjs:442. Nothing tracks them, and the code is unchanged on v2/main.
The deeper problem: CodeQL never looks at v2/main

CodeQL runs as default setup (languages: actions, javascript-typescript, schedule: weekly). Default setup analyzes the default branch (main) and PRs that target it. Every analysis on record is refs/heads/main or a PR into main, and the only PRs analyzed are the four milestone merges (#2304, #2381, #2456, #2536).

So no v2 development work is scanned until the milestone merge. A nightly sweep of the alerts cannot fix that on its own: an alert for code on v2/main does not exist until that code reaches a PR against main. It is the same blind spot AGENTS.md already records for Dependabot ("a vulnerable dependency introduced on v2/main and not yet merged to main produces no alert at all"), and for CodeQL it covers every line of first-party code.

Goal

A nightly sweep turns open Dependabot and code-scanning alerts into board-tracked issues, one per actionable finding, with no duplicates, the same way dependabot-alerts.yml does for Dependabot today.

Scanning v2/main itself, so that those alerts exist for v2 code before the release PR, is split out as #2545.

Design sketch

The sweep

Extend scripts/dependabot-alerts.mjs into a security-alert sweep, or add a sibling scripts/code-scanning-alerts.mjs with a shared filing and boarding core. It keeps the existing sweep's invariants:

  • Re-check against v2/main before filing. Dependabot re-checks each vulnerable range against v2/main's lockfile. For code scanning, the equivalent is to take the alert on the v2/main ref once #2545 makes that ref exist. Until then, check that the alert's file and line still hold the flagged code on v2/main, and skip one already fixed there.
  • One issue per finding, deduplicated by a marker that encodes tool + rule + alert number, with markers trusted only on automation-authored issues (the AGENTS.md rule, since the repo is public).
  • Board it directly at Todo / High once the credential exists, the same standing override the Dependabot sweep uses. Without the credential, fall back to the labeled, milestoned triage hand-off.
  • Fail loudly on a bad listing (rate limit, truncated or 5xx response) and write nothing, as #2425 made the Dependabot sweep do.
  • Never close an issue. A fixed alert closes itself; closing its issue is a maintainer act.
  • No model in any write-capable job. This sweep is deterministic and needs none.

Out of scope unless we choose it: secret scanning (GET …/secret-scanning/alerts). It is a third alert type, would need its own read permission, and its alerts should not be copied into a public issue body. Decide explicitly rather than by omission.

Credential

The GitHub App is now its own issue, #2544, and its permission list there already includes what this sweep needs:

Permission (GitHub App) Needed for Workflow permissions: equivalent
Repository → Dependabot alerts: read GET …/dependabot/alerts vulnerability-alerts: read
Repository → Code scanning alerts: read GET …/code-scanning/alerts security-events: read
Repository → Administration: read (optional) turns the sweep's automated-security-fixes check from UNVERIFIED into a real assertion none: GITHUB_TOKEN cannot hold it
Repository → Secret scanning alerts: read (only if secret scanning is in scope) GET …/secret-scanning/alerts secret-scanning-alerts: read

Both reads are available to GITHUB_TOKEN through workflow permissions:, so the listing half does not strictly need the App. Only the board write does. Putting everything on the App still keeps the sweep to one identity with one scope list, so add the two read permissions when the App is created.

Blocked on

#2544 (the GitHub App), for the board write. Part of tracker #2543.

Acceptance

  • A nightly sweep files one issue per open, unfixed-on-v2/main Dependabot and code-scanning alert, deduplicated, and boards it at Todo / High when the credential is present
  • The sweep fails loudly, writing nothing, on a rate-limited or malformed listing
  • The sweep would file today's open alerts; #74, #75 and #76 are being fixed directly in #2546
Ngôn ngữ chính
TypeScript
Star
11.1k
Fork
1.6k
Merge trung bình
5 giờ 29 phút
Pull request đã merge (30 ngày)
158

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của modelcontextprotocol/inspector

Tất cả issue của modelcontextprotocol/inspector

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.