fix(audit): drop Dependabot alerts whose manifest is not in the checkout

Merged
CL
1d ago
+105-4

Requested by Nikolas Garza · Slack thread

Description

Before: The CVE audit reported every open Dependabot alert, even when the alert named a manifest that is not in the checkout. For example, issue #16345 cited alert #1369 for loadtest/uv.lock, which does not exist on main. The certifi and pillow fixes were already in uv.lock, but the finding came back on each run.

After: The audit drops a Dependabot alert when its manifest path is not a file in the checkout. An alert with no manifest path stays, and so does every alert if the repo root cannot be found.

What it does: stops stale Dependabot alerts from becoming audit findings and tracking issues.

How: auditDependabot calls the new dropMissingManifests after parsing the alerts. It resolves each manifest path against the git root. Table-driven tests cover the filter, and one test runs auditDependabot with a fake gh. Existing test fixtures now create the pyproject.toml their alert cites.

Not done

  • Installed-version check: the tool has no lockfile reader that returns the installed version of an arbitrary package. The OSV scan only reports vulnerable packages. I did not add a new parser. An alert for a manifest that exists, with a fix already installed, still shows until Dependabot closes it.
  • "Also failed on this run" replies: PlanAnnouncement only knows the advisory-to-thread map. It has no record of earlier replies, and the existing tests expect the reply on each failing run. Skipping it needs new persistent state, so I made no change.

How Has This Been Tested?

go build ./... && go vet ./... && go test ./... in tools/ods all pass. pre-commit is not installed in this environment, so it did not run.

Linear: none. No Linear link in this PR.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Generated by Claude Code

Summary by cubic

Stops the CVE audit from turning stale Dependabot alerts into findings and tracking issues when the alert's manifest no longer exists in the checkout.

  • The audit drops alerts whose manifest path is not a file in the git root; alerts without a manifest path, and all alerts when the repo root cannot be found, are kept.
  • No installed-version check was added: an alert for a manifest that exists still shows even when the fix is already installed.

Summary by CodeRabbit

  • Bug Fixes

    • Removed dependency audit findings associated with manifest files that are missing from the checked-out repository.
    • Continued retaining findings without manifest paths and findings when the repository location cannot be determined.

  • Tests

    • Added coverage for missing, nested, directory-based, and manifest-free dependency findings.
    • Updated audit scenarios to include Python project manifest fixtures.