Weekly: Promote nightly to main (2026-08-17) - #1255
Open
github-actions[bot] wants to merge 60 commits into
Open
Conversation
Root: @axe-core/playwright ^4.12.1 -> ^4.13.0, overrides.smol-toml ^1.7.1 -> ^1.8.0. Frontend: knip ^6.32.1 -> ^6.32.2.
ncu throws an unhandled "Overlapping edit" rejection (upstream bug) when --dep overrides is asked to rewrite more than one entry of package.json in a single pass. Update overrides packages one at a time instead.
anchore/sbom-action resolves its pinned syft release tag against the GitHub API at job runtime; a transient upstream 5xx there fails the step even though the pin is a valid release. supply-chain-pr.yml, supply-chain-verify.yml, and docker-build.yml previously had no resilience against this. Apply the same continue-on-error + verified pinned-Syft-binary fallback that nightly-build.yml already used, so all four SBOM generation steps degrade gracefully instead of failing the job outright. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…ew fallback scripts The custom syft regex manager only watched nightly-build.yml and the security-scan skill script, so Renovate never picked up the syft-version: input consumed by anchore/sbom-action across all four workflows, nor the new SYFT_VERSION bash fallback added to supply-chain-pr.yml, supply-chain-verify.yml, and docker-build.yml. Widen file coverage to all four workflows and add a matchString for the syft-version: field so both pins stay renovate-tracked. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Wrap the direct Grype install.sh download in a bounded retry loop with backoff so a single transient GitHub failure (503s, rate limiting) during that step doesn't fail the supply-chain-pr job. Pinned version and install target are unchanged; install.sh's own internal verification is untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…and add CI parity guard Adds a backward-compatible SEMGREP_SARIF_OUTPUT hook to semgrep-scan.sh so CI can reuse the exact same rule configs, exclusions, and severity gate as the local pre-commit/pre-push scan instead of duplicating them in workflow YAML. Every existing call site (lefthook pre-commit, security-full, make security-local) never sets this var, so behavior is byte-identical to before. Adds scripts/ci/check-semgrep-parity.sh, a structural guard that verifies the upcoming Semgrep CI workflow keeps delegating to this script rather than reintroducing an inline semgrep invocation. Also extracts the branch-list assertion helpers shared between check-codeql-parity.sh and check-semgrep-parity.sh into scripts/ci/lib/workflow-yaml-asserts.sh (no behavior change).
…dSec binaries Pin golang.org/x/mod to the fixed release in the crowdsec-builder Docker stage, following the same explicit go-get-then-tidy pattern already used for the other transitive CVE patches in that stage. go mod tidy's MVS resolution otherwise lands on an older, vulnerable version even though Charon's own backend already depends on the fixed release. Verified locally: `docker build --target crowdsec-builder` compiles clean and `go version -m` on both /usr/local/bin/crowdsec and cscli confirms the patched module version is embedded in the resulting binaries.
…re-commit/pre-push scan Adds .github/workflows/semgrep.yml, running Semgrep inside the official semgrep/semgrep:1.173.0 container image (pinned by tag + digest), triggered on pull_request/push to [main, nightly, development], workflow_dispatch, and a weekly schedule. The job delegates to scripts/pre-commit-hooks/semgrep-scan.sh for both a non-blocking SARIF-producing pass (uploaded to the GitHub Security tab) and a hard-fail gate pass, so CI reproduces the exact same rule configs/exclusions/severity gate as the local scan instead of maintaining a second, duplicated invocation. The parity guard from the previous commit runs first to structurally verify this stays true. Mirrors codeql.yml's trigger/concurrency/permissions shape and security-pr.yml's SARIF-then-gate step split, reusing the same pinned actions/checkout, codeql-action/upload-sarif, and upload-artifact SHAs already in use elsewhere in this repo.
Adds Semgrep to SECURITY.md's Automated Scanning table and describes the new semgrep.yml workflow under Scanning Workflows. Updates ARCHITECTURE.md's tech-stack table, CI Jobs list, and Container Scanning components list to include Semgrep alongside the existing Trivy/CodeQL/Grype coverage.
The "Diagnose unsuppressed PR Trivy blockers" step's per-finding jq
program was double-escaping double quotes (\") inside an already
single-quoted bash string, so bash passed literal backslashes through
to jq and the program failed to compile ("unexpected INVALID_CHARACTER").
The step's pass/fail gate was unaffected (it reads FINDINGS_COUNT from a
separate, correctly-escaped jq call), but the per-finding detail lines
always fell back to "unable to render parsed findings".
Also widened the package-name capture regex to include `/`, since Go
module paths (e.g. golang.org/x/mod) were being truncated at the first
slash.
Verified by replaying the actual SARIF shape from the failed run
(PR #1249) through both the old and new jq programs locally.
Add a custom regex manager so Renovate opens update PRs for the semgrep/semgrep container image pinned in .github/workflows/semgrep.yml, matching this repo's existing pattern for other pinned image digests.
Record the final plan revisions and QA verification results from the Semgrep CI rollout, and track the two known CI-only follow-ups (timeout tuning, Renovate coverage) as a manual test plan to verify once the workflow runs for real.
Grype v0.110.0 (the default pulled by anchore/scan-action@v7.4.0, no grype-version pin set) cannot parse CycloneDX spec 1.7 as emitted by syft v1.51.0, causing verify-nightly-supply-chain to fail with "sbom format not recognized". Switch SBOM generation (primary and pinned-Syft fallback) and its jq validation back to SPDX-JSON, which the pinned Grype version parses correctly.
hecate_ws_handler.go and stats_handler.go both use the shared upgrader in logs_ws.go, which already enforces CheckOrigin. Replace the nosemgrep comments with a plain note pointing at the real check, matching cerberus_logs_ws.go.
cerberus_logs_ws.go already had the explanatory comment but still carried the nosemgrep tag from before the shared upgrader's CheckOrigin was added. Matches the cleanup already applied to hecate_ws_handler.go and stats_handler.go.
Reverts the prior cleanup that dropped the inline nosemgrep tags. Semgrep's OSS engine can't do cross-file analysis to see that the shared upgrader (logs_ws.go) already has CheckOrigin configured, so without the suppression it flags every call site independently and blocks CI. Keep the explanatory comment plus the suppression.
…WS upgrade call site Semgrep's SARIF output still records nosemgrep-suppressed findings (for audit purposes), and GitHub code scanning wasn't auto-dismissing those instances, so alerts stayed open despite CI passing. Semgrep's OSS engine can't do cross-file analysis to see the shared upgrader's CheckOrigin from a different file. Add upgradeWebSocket(c) in logs_ws.go, next to the CheckOrigin-configured upgrader, and route every handler through it instead of calling upgrader.Upgrade directly. The actual Upgrade call now lives in the same file as the origin check, so the rule no longer fires and no suppression is needed anywhere.
…dSec and Caddy binaries Pins the dependency to its fixed release in both build stages, same pattern used for the existing golang.org/x/crypto patch, and adds a Renovate customManager entry to track future bumps.
Automated checksum update for GeoLite2-Country.mmdb database. Old: b4f624e1411c28701d724503b8d15ed4997de70cb6ea05d6f11bf572ea552240 New: 8cc00bbcd9734df804acc36196c84abe65c2ef4beb4294c2bf4d25ac356db933 Auto-generated by: .github/workflows/update-geolite2.yml
github-actions
Bot
added
automated
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Weekly Nightly to Main Promotion
Date: 2026-08-17
Trigger: Scheduled weekly promotion
Commits: 60 commits to promote
Changes: 46 files changed, 1484 insertions(+), 908 deletions(-)
Commits Being Promoted
Showing first 50 of 60 commits:
...and 10 more commits
Pre-Merge Checklist
Once all checks pass:
This PR was automatically created by the Weekly Nightly Promotion workflow.