fix(security): fail closed on unavailable dependency review

[seonghobae]

Purpose

Close the fail-open merge gate in the org-required Security Scan dependency-review job (#810). On current main, a GitHub compare/dependency-graph probe that returns HTTP 403/404 sets supported=false, skips actions/dependency-review-action, and exits 0. Live evidence: ContextualWisdomLab/EgressWeave#66, Security Scan run 31108241013, job 92638903658 (compare 10d0c51d…c038a950 returned HTTP 403 and the job still succeeded). Downstream: ContextualWisdomLab/EgressWeave#76.

This head now also closes the CHANGES_REQUESTED gap on #1042: empty, named, or ../ identity can no longer be interpolated into the compare URL and mint supported=true from a forged HTTP 200.

Do not close #810 from this PR. Leave it open until an EgressWeave (or other protected-main public consumer) canary proves a non-200 or failed-transfer comparison cannot green the Dependency Review job.

What changed

• The support probe no longer uses || true. Curl's transport exit is captured separately from the printed HTTP status.
• Identity is validated before curl: both SHAs must be 40- or 64-character hex; the repository must be canonical owner/name without ./.. segments (.github remains legal). Failures use HTTP unavailable and curl exit uncalled and do not echo raw identity.
• HTTP 403, 404, empty, curl 000, malformed, or any non-zero curl exit (including exit 18 with a printed 200) fails the job.
• After a successful HTTP 200 with curl exit 0, the pinned actions/dependency-review-action runs unconditionally.
• Failure diagnostics record allowlisted visibility, and after a real probe the exact base/head SHAs, HTTP status, and curl exit. The response body is discarded.
• Queue-contract regressions cover the EgressWeave ci: trust same-head OpenCode review OID #66 HTTP 403 canary, curl-exit-18, curl 000, named-ref rejection, dot-segment rejection, argv proof on the success path, and credential non-leakage.

Verification

Local (75d942df):

• pytest tests/test_required_workflow_queue_contract.py: 75 passed
• Dependency-review subset: 26 passed

Acceptance

• HTTP 403/404/empty/malformed/transport-failure cannot skip the gate
• Successful HTTP 200 probe runs the pinned action unconditionally
• Identity validated before network; raw invalid identity is not logged
• Allowlisted visibility + HTTP status + curl exit; no response body
• Regression for curl exit 18 + printed 200, curl 000, named refs, and ./.. segments
• Exact-current-head required checks terminal and clean
• Do not close security: make central dependency-review unavailability fail closed #810 until an EgressWeave canary proves a non-200 cannot green the job

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0bff2aeb-4d50-4871-977d-ebd77fc37ec0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale comment

Verdict

COMMENT.

This ready-for-review copy of the fail-closed probe is weaker than #1044: it still treats curl 000 as a three-digit HTTP status, and its probe harness spreads the full process environment into the extracted script.

Operator next step

Prefer #1044 for integration. Do not approve or merge this head over that successor. Keep #810 open until a protected-main public consumer run proves a non-200 cannot go green.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Stale comment

Verdict

REQUEST_CHANGES on exact head e69bd3516ee94d42bbe11335effefc5af6c57cba.

The HTTP 403/404 and transport fail-closed probe is source-correct, but this ready PR still interpolates unvalidated revisions and repository names into the compare URL. An empty SHA or ../ repository can therefore mint supported=true from a forged HTTP 200. The success test does not prove the compare URL was requested.

Do not merge this PR. Prefer #1045, which continues the #1041 canary/visibility work and adds pre-network identity validation plus compare-argv proof. Keep #810 open until a protected-main public consumer run proves a non-200 cannot go green.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Curl runs before any revision or repository-name check. Empty or ../ identity is interpolated into the compare URL and a forged HTTP 200 writes supported=true.

Fail closed with HTTP unavailable and curl exit uncalled unless both SHAs are 40- or 64-character hex and the repository is canonical owner/name. Use #1045.

[cursor]

Verdict

COMMENT on closed head e69bd351. Do not reopen this pull request.

The production probe on this head is fail-closed for HTTP 403/404, empty or malformed status, and curl exit 18 with a printed 200. That is a real repair versus protected main. It is not the integration vehicle.

Why this head is not the landing vehicle

1. The executable contract is a weaker subset of #1048: this head inherits os.environ in the probe harness and does not pin credential non-leakage, the EgressWeave #66 HTTP 403 canary, curl 000, or named-ref rejection.
2. A later residual remains even on #1048: ../.github and ContextualWisdomLab/.. still match the single-slash owner/name regex. RFC 3986 remove-dot-segments would collapse those into a different compare URL.

Operator next step

1. Prefer #1050 (29a20baa) for integration. It continues #1048 and rejects ./.. path components while keeping ContextualWisdomLab/.github legal.
2. Keep #810 open until a protected-main public consumer run proves a non-200 cannot green Dependency Review.
3. Do not merge #897, #1033, #1041, this pull request, #1044, #1045, or #1048 once #1050 is the integration vehicle.
4. Wait only for exact-current-head required checks and a counted non-author formal approval on #1050. Automated review is not merge authority.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Verdict

COMMENT on closed head e69bd351. Do not reopen this pull request.

The production probe on this head is fail-closed for HTTP 403/404, empty or malformed status, and curl exit 18 with a printed 200. That is a real repair versus protected main. It is not the integration vehicle.

Why this head is not the landing vehicle

1. The executable contract is a weaker subset of later heads: this harness inherits os.environ and does not pin credential non-leakage, the EgressWeave #66 HTTP 403 canary, curl 000, named-ref rejection, or ./.. path-segment rejection.
2. A concurrent successor already closed those gaps.

Operator next step

1. Prefer #1049 (e4a7dffa) for integration. It rejects ./.. segments, keeps ContextualWisdomLab/.github legal, hides raw invalid identity, and classifies curl 000 as unavailable.
2. Treat #1050 as a historical duplicate of that same slice. Do not merge #1050.
3. Keep #810 open until a protected-main public consumer run proves a non-200 cannot green Dependency Review.
4. Do not merge #897, #1033, #1041, this pull request, #1044, #1045, #1048, or #1050 once #1049 is the integration vehicle.
5. Wait only for exact-current-head required checks and a counted non-author formal approval on #1049. Automated review is not merge authority.

View PR

  

_{Sent by Cursor Automation: Fix Issues}