ci(cve-alerts): let the fix bot edit compiled requirements files

Merged
CL
1d ago
+69-9

Requested by Nikolas Garza · Slack thread

Before: The CVE Alerts fix bot could edit only package.json and pyproject.toml (plus regenerated lockfiles). It could not fix a pin in initial-requirements.txt, so the audit kept failing.

After: The bot can also edit compiled requirements files (*requirements*.txt, today only initial-requirements.txt). It still rejects source code, workflows, and all other files.

This lets the bot fix a pin in any manifest file that the audit can fail on and that the workflow can safely validate.

How: PR #16337 missed a certifi pin in initial-requirements.txt, and #16361 fixed it by hand. The change adds **/*requirements*.txt to the editable file list and to the patch allowlist in cve-alerts.yml. cve-check-manifests.ts now checks .txt edits: only the package's == line may change, and only to the fixed version. cve-fix.md tells the bot to edit that line and keep the header and # via comments. backend/requirements/*.txt stay workflow-regenerated and off-limits to the bot. Go and Rust alerts stay out of scope, because the bot has no regeneration step for them.

Linear: none

Generated by Claude Code

Summary by cubic

Lets the CVE Alerts fix bot edit compiled requirements files so it can fix a pin in initial-requirements.txt instead of leaving the audit failing.

  • Requirements files are validated line by line: only the package's plain == pin may change to the fixed version, byte-identical elsewhere.
  • backend/requirements/*.txt stay workflow-regenerated and off-limits; source code, workflows, and other files are still rejected.

Summary by CodeRabbit

  • Bug Fixes

    • CVE checks now include supported Python requirements*.txt files alongside existing dependency manifests.
    • Dependency updates are validated line by line to require exact fixed versions while preserving file structure and metadata.
    • Unsupported requirement syntax and unsafe version changes are rejected during validation.

  • Documentation

    • Dependency-fix guidance now covers compiled requirements files and preserves generated metadata during updates.