supabase / etl / 42011969031

81%

Build Type

push

github

Committed by web-flow

Commit Message

feat(xtask): Collect Dependabot alerts (#1210)

* feat(xtask): Collect Dependabot alerts

The dashboard's open security alert count read only code-scanning
alerts, so open Dependabot alerts never showed. Sync every Dependabot
alert into ci.dependabot_alert and add them to ci_report.security_daily
as tool 'Dependabot', so existing panels count them without changes.

The endpoint rejects the page parameter, so the sync follows the after
cursor from the link header. The workflow grants the read-only
vulnerability-alerts permission; actionlint 1.7.12 does not know it
yet, so its error is ignored for this workflow only. A 403 skips
Dependabot without failing the sync, as for code scanning.

Run cargo x ci-metrics migrate as the owner when this reaches main;
syncs fail the schema check until then.

* fix(xtask): Address Dependabot review findings

Sync Dependabot before code scanning, so an analyses backfill cannot
spend the shared reserve and leave Dependabot alerts stale. Accept
alerts without a package or manifest, which GitHub's schema allows,
instead of failing the whole page. Complete the migration's rollback
note: the reverted collector also needs version 20261105000000 removed
from ci._sqlx_migrations.

* feat(xtask): Collect dependency audit findings

The dependency audit job reported its cargo deny advisories only in its
log, and Dependabot misses some of them: today cargo deny reports
pulldown-cmark, zstd and zstd-safe advisories that have no Dependabot
alert. Record them the way test jobs record their results.

On runs outside pull requests, the audit job writes an audit manifest
from cargo deny's JSON output and uploads it as audit-results-<job id>,
also when the check fails. A broken manifest does not fail the audit.
The collector ingests these manifests from runs on main only, validates
them, and stores one ci.audit_finding row per advisory and crate
version. ci_report.dependency_audit lists every stored audit, including
clean ones, and ci_re... (continued)

Coverage Stats

251 of 425 new or added lines in 4 files covered. (59.06%)

53 existing lines in 7 files now uncovered.

61331 of 76044 relevant lines covered (80.65%)

23263.84 hits per line