From bcea5f15b72290893de668406acb10304400407f Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Thu, 11 Jun 2026 09:08:30 +0200 Subject: [PATCH] ci: run osv-scanner in CI, not push-check (T-353) Keep the security gate out of the local pre-push path so dev machines don't need osv-scanner installed. The `make security` target and ci/osv_scan.sh stay for the CI PR-merge pipeline (and on-demand local runs); only the push-check prerequisite is removed, with a NOTE in the Makefile explaining where it runs instead. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 11 ++++++----- Makefile | 8 ++++++-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 16b6c64d..a1f88f3f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,11 +25,12 @@ heading, and (b) bumping `pubspec.yaml` `version:` in the same commit. `xml` 7.0.1), `mocktail` 1.0.4→1.0.5. Deliberately held with reasons in `pubspec.yaml`: `markdown` (7.3.1 needs Dart 3.9), `alchemist` (0.13 golden churn), `test` (Flutter-SDK locked). (T-353) -- **Supply-chain gate in `make push-check`.** A new `security` step runs - `osv-scanner` over `pubspec.lock` and fails the push if any resolved - dependency has a known advisory — a hard gate on top of `dart pub`'s passive, - non-failing advisory print. Requires `osv-scanner` on PATH - (`brew install osv-scanner`). (T-353) +- **Supply-chain gate (`make security`).** A new `security` target runs + `osv-scanner` over `pubspec.lock` and fails if any resolved dependency has a + known advisory — a hard gate on top of `dart pub`'s passive, non-failing + advisory print. Intended for the CI PR-merge pipeline (kept out of + `push-check` so dev machines don't need the scanner installed); run locally + any time with `make security`. (T-353) ## [2.3.2] — 2026-06-11 diff --git a/Makefile b/Makefile index f9757514..86048b02 100644 --- a/Makefile +++ b/Makefile @@ -309,7 +309,7 @@ clide-cli-clean: ## Remove the compiled C `clide` client. # -- security ------------------------------------------------------------- .PHONY: security -security: ## Supply-chain gate — osv-scanner over pubspec.lock (fails on a known advisory). +security: ## Supply-chain gate — osv-scanner over pubspec.lock (CI PR-merge pipeline; run locally on demand). Fails on a known advisory. ci/osv_scan.sh # -- pre-push gate -------------------------------------------------------- @@ -319,7 +319,11 @@ decisions-validate: ## Parser dry-run over governance/{decisions,questions,rejec pql decisions validate .PHONY: push-check -push-check: decisions-validate changelog-gate security test-coverage coverage-gate test-core ## Pre-push gate (fast — <2 min target). Order is fail-fast: instant gates (decisions, changelog, security/osv) first, then the coverage suite + gate (the expensive, most-likely-to-fail stage) BEFORE test-core — a coverage miss aborts here instead of after running everything, so a fix doesn't force a full re-run of the rest. test-coverage already runs the a11y suite (test/a11y), so no separate test-a11y pass. +# NOTE: the `security` (osv-scanner) gate is deliberately NOT in push-check — +# it runs in the CI PR-merge pipeline (where the scanner is provisioned) so we +# don't force every dev machine to install osv-scanner. Run it locally any time +# with `make security`. +push-check: decisions-validate changelog-gate test-coverage coverage-gate test-core ## Pre-push gate (fast — <2 min target). Order is fail-fast: instant gates (decisions, changelog) first, then the coverage suite + gate (the expensive, most-likely-to-fail stage) BEFORE test-core — a coverage miss aborts here instead of after running everything, so a fix doesn't force a full re-run of the rest. test-coverage already runs the a11y suite (test/a11y), so no separate test-a11y pass. .PHONY: push-check-full push-check-full: push-check test-integration smoke-bundle ## Pre-release gate (push-check + integration + smoke; slower).