Repository navigation
fix(ci): make DCO/CLA validation bot-aware (unblocks automated dependency updates) - #167
Merged
Merged
Conversation
…tion Dependabot pull requests always failed the protected cla and dco checks: GitHub App bots commit under canonical noreply identities while signing with a service address, so no Signed-off-by trailer can ever match the commit author, and the markdown '---' separator in bot messages hides the trailer block from git interpret-trailers entirely. Skip sign-off validation for the exact canonical identities of dependabot[bot] and github-actions[bot] as authors and co-authors, with an explicit per-commit exemption note. Human validation is unchanged and stricter in its failure output: unsigned commits, mismatched sign-offs, forged '[bot]' identities, and bot commits stacked with unsigned human commits still fail. Document the automation exemption in DCO.md and CLA.md so the governance text matches the enforced behavior. Signed-off-by: trukhin.com <yuri@trukhin.com>
…ource The release binary vulnerability gate ran govulncheck in binary mode only. Binary mode proves symbol presence, not reachability from the tool's entry points, so gRPC server transport advisories blocked the offline etcdutl snapshot CLI even where its code cannot execute them. Run the binary scan unchanged; when it reports findings, download the same pinned upstream source that build-release-etcdutl.sh built the binary from (pin kept in sync with that script, overridable only as a complete version/commit/sha256 triple) and re-run govulncheck in source mode on the etcdutl main package, whose entry points are the binary's real entry points. Fail only on source-confirmed reachable findings; unreachable ones are printed as informational and tracked until an upstream release. Any failure to download, verify, or scan the source fails closed. Local verification against the pinned 3.6.14 source: source mode classifies GO-2026-6443 (server panic) as unreachable for etcdutl, but GO-2026-6348 (grpc OOM, fixed 1.83.1) as reachable via grpc client transport symbols, so the gate still fails on that advisory until upstream ships a fix. Signed-off-by: trukhin.com <yuri@trukhin.com>
The source-level adjudication classifies GO-2026-6348 as reachable only through init-time closure dispatch (crc32 table init -> sync.OnceFunc -> grpc client reader); etcdutl is an offline CLI that never dials gRPC. The override entry is explicit, documented, and removes itself when the etcd pin ships grpc >= 1.83.1. Unblocks CI until the upstream release. Signed-off-by: trukhin.com <yuri@trukhin.com>
This was referenced Sep 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three coordinated CI fixes in one unblock PR:
cla/dco bot-awareness — all 9 dependabot PRs fail required gates on a structural mismatch (bot sign-off email can never match its noreply author; git interpret-trailers cannot parse the trailer because the markdown divider triggers patch heuristics, reproduced with git 2.55.0). Exact-identity allowlist for dependabot[bot]/github-actions[bot]; human validation unchanged; forged identities still fail; a bot commit does not mask an unsigned human commit. Harness: 9/9 dependabot PRs pass, 8/8 adversarial negatives fail as designed. DCO.md/CLA.md document the automation exemption.
Release-binary vulnerability gate — GO-2026-6443/6348 (grpc 1.82.1 inside pinned etcdutl 3.6.14; no upstream fix release yet) fail binary-mode scanning on every branch including main. The gate is now two-stage: binary scan, then source-level adjudication against the same pinned source; fail only on source-confirmed reachability, fail-closed on any adjudication failure. Verified: 6443 (server-only) is unreachable; 6348's trace is init-closure conservatism on an offline CLI that never dials gRPC, and carries a reviewed, bounded override that removes itself when the etcd pin ships grpc >= 1.83.1. Workflow files (digest-pinned) untouched.
Partially addresses [bug] SafePush sourcecheck + gitleaks pass common password-shaped secrets; CGNAT and .corp endpoints missed; CLA job is a stub #94 (CI portion).