CI: report Clojure dependencies so Dependabot alerts cover them by codeGlaze · Pull Request #49 · codeGlaze/orcpub

codeGlaze · 2026-10-05T01:02:27Z

Reports the app's Clojure and Java libraries to GitHub's dependency graph, so the Dependabot alerts turned on today cover them. Dependabot cannot read project.clj; lein pom writes the same dependencies as a Maven pom, and advanced-security/maven-dependency-submission-action (pinned to a commit) resolves and uploads them. It needs no secrets.

A separate dependency-graph job in the main CI. It runs only on pushes and manual runs, and it is the only job with contents: write. The test job, which runs pull-request code, keeps the read-only default.
The shared setup now lives once, in .github/actions/setup-lein: JDK, Leiningen, the Maven cache, the local libs, Datomic Pro, and lein deps. Both jobs use it.
No weekly schedule. GitHub re-checks a submitted graph against new advisories by itself.

A test run on this branch submitted 245 packages ("Snapshot successfully created").

Dependabot cannot read project.clj, so it watched only the workflows and the npm test tools. lein pom writes the dependencies as a Maven pom, which the submission action resolves and uploads; Dependabot alerts then cover the server's libraries. Weekly, on pushes and on pull requests.

…ond workflow The standalone workflow failed at Leiningen setup: the project's plugins and Datomic Pro need the setup the main job already does (local libs into ~/.m2, Datomic Pro installed). Submitting after its lein deps avoids duplicating forty lines. Push and manual runs only; a weekly schedule is not needed, because GitHub re-checks a submitted graph against new advisories by itself.

greptile-apps · 2026-10-05T01:06:02Z

Confidence Score: 2/5

[Medium risk] Adds a CI workflow to report Clojure dependencies.

This PR is not safe to merge until pull-request execution is separated from write-capable submission and fork runs are handled.

Findings

PR code gets write credentials ▶
Fork PR submissions fail ▶
Privileged action uses mutable tag ▶

Fix with agent prompt

### Issue 1
.github/workflows/dependency-graph.yml:26
On a same-repository pull request that changes `project.clj`, this job checks out the proposed code and runs `lein pom`, which evaluates that file. Because the job has `contents: write` and checkout persists its token, code in the PR can use repository write credentials before it is merged. Run PR code with read-only permissions and reserve write-capable submission for a trusted context.

**How this was verified:** The pull-request job grants `contents: write`, checkout persists its token, and `lein pom` evaluates the checked-out `project.clj`.

### Issue 2
.github/workflows/dependency-graph.yml:18-19
When a pull request comes from a fork, its `GITHUB_TOKEN` is read-only despite this workflow requesting `contents: write`. The submission step uses that token, so it cannot upload the snapshot to the repository’s dependency graph. The new workflow fails for external contributors instead of reporting their dependencies.

### Issue 3
.github/workflows/dependency-graph.yml:58
The third-party submission action runs with `contents: write` but is referenced by the mutable `@v4` tag. If that tag changes upstream, different code can run with the job’s write credential without a change in this repository. Pinning it to an immutable commit would make updates deliberate.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR adds a workflow that generates a Maven POM from project.clj, resolves and submits its dependencies to GitHub, and documents that coverage in the changelog.

Pull-request submission needs separate handling for trusted write access and fork credentials.
The privileged third-party action should use an immutable reference.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  PR[Pull request] --> Checkout[Checkout PR code]
  Checkout --> Pom[lein pom evaluates project.clj]
  Pom --> Submit[Submit dependency snapshot]
  Pom --> Token[Persisted job token]
  Submit --> Graph[Dependency graph]

_{Reviews (1) · Last reviewed commit: "Record ci/clojure-cve-scan in CHANGELOG...."}

greptile-apps · 2026-10-05T01:06:05Z

+  workflow_dispatch:
+
+permissions:
+  contents: write


PR code gets write credentials
On a same-repository pull request that changes project.clj, this job checks out the proposed code and runs lein pom, which evaluates that file. Because the job has contents: write and checkout persists its token, code in the PR can use repository write credentials before it is merged. Run PR code with read-only permissions and reserve write-capable submission for a trusted context.

How this was verified: The pull-request job grants contents: write, checkout persists its token, and lein pom evaluates the checked-out project.clj.

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/dependency-graph.yml Line: 26 Comment: **PR code gets write credentials** On a same-repository pull request that changes `project.clj`, this job checks out the proposed code and runs `lein pom`, which evaluates that file. Because the job has `contents: write` and checkout persists its token, code in the PR can use repository write credentials before it is merged. Run PR code with read-only permissions and reserve write-capable submission for a trusted context. **How this was verified:** The pull-request job grants `contents: write`, checkout persists its token, and `lein pom` evaluates the checked-out `project.clj`. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fixed in 050e7d4: pinned to fe8d4d650a4b66508612d0683ce4726d51dfe6ac, the commit v4 resolved to in our first run.

greptile-apps · 2026-10-05T01:06:05Z

+  pull_request:
+    branches: [integration, develop, main]


Fork PR submissions fail
When a pull request comes from a fork, its GITHUB_TOKEN is read-only despite this workflow requesting contents: write. The submission step uses that token, so it cannot upload the snapshot to the repository’s dependency graph. The new workflow fails for external contributors instead of reporting their dependencies.

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/dependency-graph.yml Line: 18-19 Comment: **Fork PR submissions fail** When a pull request comes from a fork, its `GITHUB_TOKEN` is read-only despite this workflow requesting `contents: write`. The submission step uses that token, so it cannot upload the snapshot to the repository’s dependency graph. The new workflow fails for external contributors instead of reporting their dependencies. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fixed in 050e7d4: pinned to fe8d4d650a4b66508612d0683ce4726d51dfe6ac, the commit v4 resolved to in our first run.

greptile-apps · 2026-10-05T01:06:05Z

+          sed -i 's#http://repository.apache.org#https://repository.apache.org#' pom.xml
+
+      - name: Submit the dependency snapshot
+        uses: advanced-security/maven-dependency-submission-action@v4


Privileged action uses mutable tag
The third-party submission action runs with contents: write but is referenced by the mutable @v4 tag. If that tag changes upstream, different code can run with the job’s write credential without a change in this repository. Pinning it to an immutable commit would make updates deliberate.

Prompt To Fix With AI

This is a comment left during a code review. Path: .github/workflows/dependency-graph.yml Line: 58 Comment: **Privileged action uses mutable tag** The third-party submission action runs with `contents: write` but is referenced by the mutable `@v4` tag. If that tag changes upstream, different code can run with the job’s write credential without a change in this repository. Pinning it to an immutable commit would make updates deliberate. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fixed in 050e7d4: pinned to fe8d4d650a4b66508612d0683ce4726d51dfe6ac, the commit v4 resolved to in our first run.

…a local action Greptile on #49: the test job runs pull-request code, so it must not hold contents: write. The submission is now a separate push-only job, the only one with write access, and the setup both jobs need (JDK, Leiningen, Maven cache, local libs, Datomic Pro, lein deps) lives once in .github/actions/setup-lein. The third-party submission action is pinned to a commit.

… accounts, #49) Brings the shared picks namespace this branch's step 1 builds on. No conflicts; no duplicate definitions.

codeGlaze added 3 commits October 4, 2026 21:02

Record ci/clojure-cve-scan in CHANGELOG.md under Summer Patch

d4ce7a9

greptile-apps Bot reviewed Oct 5, 2026

View reviewed changes

codeGlaze merged commit 7fd62f9 into integration Oct 5, 2026
8 checks passed

codeGlaze deleted the ci/clojure-cve-scan branch October 5, 2026 01:49

codeGlaze added a commit that referenced this pull request Oct 5, 2026

Merge integration into fix/hidden-multiclass-skill-pick (#47 picks, #48…

756d97d

… accounts, #49) Brings the shared picks namespace this branch's step 1 builds on. No conflicts; no duplicate definitions.

Navigation Menu

Repository navigation

CI: report Clojure dependencies so Dependabot alerts cover them - #49

CI: report Clojure dependencies so Dependabot alerts cover them#49
codeGlaze merged 4 commits into
integrationfrom
ci/clojure-cve-scan

codeGlaze commented Oct 5, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Oct 5, 2026

Uh oh!

codeGlaze Oct 5, 2026

Uh oh!

greptile-apps Bot Oct 5, 2026

Uh oh!

codeGlaze Oct 5, 2026

Uh oh!

greptile-apps Bot Oct 5, 2026

Uh oh!

codeGlaze Oct 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

codeGlaze commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 2/5

Findings

Uh oh!

greptile-apps Bot Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

codeGlaze Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

codeGlaze Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

codeGlaze Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codeGlaze commented Oct 5, 2026 •

edited

Loading

greptile-apps Bot commented Oct 5, 2026 •

edited

Loading