ci: Set up automated dependency vulnerability checks for Rust and Kotlin#104
Conversation
- Added `.github/workflows/security-dependencies.yml` for daily scans and push-time audits. - Uses `cargo-deny` for Rust security advisory checks in `clients/agent-runtime`. - Uses `gradle/actions/dependency-submission` to enable GitHub native security alerts for Kotlin. - Added `.github/workflows/dependency-review.yml` to block PRs introducing vulnerable dependencies. - Verified Renovate configuration in `.github/renovate.json` for security alert handling. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
Deploying corvus with
|
| Latest commit: |
a0951b6
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8c6c0ad7.corvus-42x.pages.dev |
| Branch Preview URL: | https://setup-dependency-security-sc.corvus-42x.pages.dev |
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughAdds two GitHub Actions workflows: one that runs a dependency review on pull requests, and another that runs scheduled and on-demand security scans — a Rust cargo-deny audit and a Kotlin dependency submission via Gradle. Changes
Sequence Diagram(s)sequenceDiagram
participant PR as Pull Request / Push
participant GH as GitHub Actions (Workflow)
participant Runner as Actions Runner (ubuntu-latest)
participant Repo as Repository (checkout)
participant Rust as Rust toolchain / cargo-deny
participant Java as Java (Corretto) / Gradle
PR->>GH: trigger dependency-review / security-dependencies
GH->>Runner: start job(s)
Runner->>Repo: actions/checkout
alt rust-audit job
Runner->>Rust: setup rust toolchain
Runner->>Rust: install cargo-deny
Runner->>Rust: run cargo-deny in clients/agent-runtime
Rust-->>Runner: advisories report
end
alt kotlin-dependency-submission job
Runner->>Java: setup Corretto 21
Runner->>Repo: use Gradle wrapper
Runner->>Java: run Gradle dependency-submission
Java-->>Runner: submission result
end
Runner-->>GH: job results
GH-->>PR: report findings (checks/status)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Contributor ReportUser: @yacosta738
Contributor Report evaluates based on public GitHub activity. Analysis period: 2025-02-28 to 2026-02-28 |
yacosta738
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/security-dependencies.yml (1)
14-32: Add explicit minimal permissions to therust-auditjob.The
kotlin-dependency-submissionjob correctly declarespermissions: contents: write, butrust-auditrelies on default token permissions. For security hardening, explicitly declare minimal permissions:🛡️ Suggested fix
rust-audit: name: Rust Security Audit runs-on: ubuntu-latest + permissions: + contents: read steps: - name: ✈ Checkout repository🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/security-dependencies.yml around lines 14 - 32, The rust-audit job is relying on default token permissions; add an explicit minimal permissions block to the rust-audit job (job id "rust-audit") to restrict the GitHub token—e.g., add permissions: contents: read directly under the rust-audit job definition so the job only has repository read access while running the checkout and cargo-deny steps.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/security-dependencies.yml:
- Around line 14-32: The rust-audit job is relying on default token permissions;
add an explicit minimal permissions block to the rust-audit job (job id
"rust-audit") to restrict the GitHub token—e.g., add permissions: contents: read
directly under the rust-audit job definition so the job only has repository read
access while running the checkout and cargo-deny steps.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/dependency-review.yml.github/workflows/security-dependencies.yml
|
@jules name: 🦀 Setup Rust toolchain
|
- Added `.github/workflows/security-dependencies.yml` for daily scans and push-time audits. - Uses `cargo-deny` for Rust security advisory checks in `clients/agent-runtime`. - Uses `gradle/actions/dependency-submission` to enable GitHub native security alerts for Kotlin. - Added `.github/workflows/dependency-review.yml` to block PRs introducing vulnerable dependencies. - Pinned all GitHub Actions to full commit SHAs for enhanced security. - Verified Renovate configuration in `.github/renovate.json` for security alert handling. Co-authored-by: yacosta738 <33158051+yacosta738@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/dependency-review.yml:
- Around line 5-8: The workflow's pull_request trigger is limited by the
branches list (the pull_request -> branches setting), so dependency-review.yml
only runs for PRs targeting main and minor; remove the branches restriction or
change the branches value to cover all targets (e.g., remove the
pull_request.branches array entirely or set it to a wildcard) so the
pull_request workflow runs for every PR target and ensures all dependency
changes are reviewed.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/dependency-review.yml.github/workflows/security-dependencies.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/security-dependencies.yml
| pull_request: | ||
| branches: | ||
| - main | ||
| - minor |
There was a problem hiding this comment.
Trigger scope is narrower than the stated “all PRs” security goal.
Lines 6-8 restrict execution to PRs targeting only main and minor, which can leave dependency risk unreviewed on other target branches.
Suggested change
on:
pull_request:
- branches:
- - main
- - minor📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| pull_request: | |
| branches: | |
| - main | |
| - minor | |
| pull_request: |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/dependency-review.yml around lines 5 - 8, The workflow's
pull_request trigger is limited by the branches list (the pull_request ->
branches setting), so dependency-review.yml only runs for PRs targeting main and
minor; remove the branches restriction or change the branches value to cover all
targets (e.g., remove the pull_request.branches array entirely or set it to a
wildcard) so the pull_request workflow runs for every PR target and ensures all
dependency changes are reviewed.
|
yacosta738
deleted the
setup-dependency-security-scans-9571813574999698774
branch
1 participant
This PR sets up a comprehensive automated dependency vulnerability scanning strategy for the project's multi-ecosystem architecture.
Key changes:
cargo-deny check advisoriesin theclients/agent-runtimedirectory. It uses the existingdeny.tomland the RustSec database to identify vulnerable crates.All workflows use pinned major versions and follow project standards (Java 21, stable Rust).
Fixes #30
PR created automatically by Jules for task 9571813574999698774 started by @yacosta738
Summary by CodeRabbit