Repository navigation
ops(security): enable exact dependency review evidence #449
Description
Verified blocker
Orgmetra PR #448 exact head 6a06062e9d4f6e07bf4780a60384f264f7983353 failed Security Scan run 36796513896, dependency-review job 110161138626.
The exact checkout identity succeeded. The job then requested GitHub's dependency comparison endpoint for protected base eb9757f8649aaad026a9865508d9aad50c1a7a4f and exact head 6a06062e9d4f6e07bf4780a60384f264f7983353:
GET /repos/ContextualWisdomLab/Orgmetra/dependency-graph/compare/{base}...{head}
The repository-scoped Actions token had contents: read, metadata: read, and pull-requests: read, but GitHub returned HTTP 403. The workflow correctly failed closed before running actions/dependency-review-action. Trivy, OSV, Scorecard, Foundation CI, and SAST passed on the same exact head; those results do not replace dependency-review evidence.
Canonical owner and action
This is an Orgmetra repository security/configuration responsibility. Do not weaken or skip the shared Security Scan and do not add a leaf suppression.
- Verify Dependency Graph is enabled for
ContextualWisdomLab/Orgmetraand that organization/repository security policy permits exact base/head dependency comparison from pull-request Actions. - Preserve least-privilege read permissions; expand token/App permission only if GitHub's documented endpoint contract demonstrably requires it.
- Re-run the failed exact-head Security Scan and require HTTP 200 plus terminal dependency-review success.
- Record the setting/permission evidence and exact rerun ID in feat(outbox): integrate governed delivery receipt into Foundation #448 and
docs/product-technical-gap-baseline.mdthrough its canonical writer.
Completion evidence
- exact base/head comparison returns HTTP 200;
- dependency-review job is terminal GREEN on the live feat(outbox): integrate governed delivery receipt into Foundation #448 head (or its verified complete successor);
- no allow-failure, skip, warning-only conversion, fork bypass, or scanner exclusion;
- qualifying independent PR approval remains separately required.
Activity
seonghobae commentedon Oct 1, 2026
Fleet impact refresh — 2026-10-01
Fresh exact job-log review confirms that the blocker is not isolated to #448. Four Ready PR heads reproduce the same fail-closed dependency-graph comparison boundary:
f1f152b0838e11cba1cf583706eb0983d56af373— Security run 34057542151, job101555915700;301f843c01f301088234c27f758c2a074cfa9aed— Security run 36796830339, job110162113278;6a06062e9d4f6e07bf4780a60384f264f7983353— Security run 36796513896, job110161138626;630e2c0a771f6dff0748307ea22b72c0ef9d0f51— Security run 36824994973, job110248616752.Every job first proved
actual_sha == expected exact head, then received HTTP 403 from/dependency-graph/compare/{develop base}...{exact head}and exited 1. On each run, OSV, Trivy, and Scorecard succeeded; they do not substitute for dependency-review evidence.All four PRs are mechanically mergeable but have zero qualifying APPROVED reviews, so none is merge-authorized independently of this shared Security blocker. Keep the repair at the repository configuration owner; do not add leaf suppressions, synthetic success, manual rerun loops, or gate weakening. After the setting/permission repair, reacquire HTTP 200 and terminal dependency-review GREEN on unchanged live heads where still current.
seonghobae commentedon Oct 3, 2026
Canonical workflow-owner linkage — refreshed 2026-10-03
The complete
.github #1725Dependency Review delta is now preserved in its canonical concurrent successorContextualWisdomLab/.github#2565. Published ordinary two-parent merge650bc6e35409d52d24fec890c2ab74063794e9b8has parents prior #2565cd2c3f9748e6bc50efd8bdfee9a385a74ec6e3baand #1725229027280e8bce6cc4f13e722b2b0c280a1ac17d; current exact headf0f7ed988fba5d94eda6513f35d171f23c4bd9a5adds a RED→GREEN ancestry receipt contract and corrects CHANGELOG/Gap evidence.The successor remains unmerged and unreleased: exact-head hosted security/control jobs fail before executable steps because
CWL CI isolatedgroup/capacity and canary proof are absent, CodeQL is Draft-skipped, and qualifying approvals are 0. Therefore #2565 is Proposed evidence only and does not resolve this Orgmetra issue; #1725 must not be retired until the successor is safely integrated.Current Orgmetra consumers remain fail-closed:
e78e79fb846ec5af7f6fe0c09cedd71357373312: Foundation, SAST and CodeQL GREEN; Security fails at Dependency Review HTTP 403.6a06062e9d4f6e07bf4780a60384f264f7983353: Foundation and SAST GREEN; Security fails at Dependency Review HTTP 403; CodeQL skipped.Required order is now
.github #2565ordinary protected integration → immutable protected SHA → Orgmetra caller pin/adoption if required → fresh exact-head HTTP 200 and terminal Dependency Review GREEN. If the released owner workflow still receives 403, this issue retains repository/organization Dependency Graph setting and permission ownership. No leaf suppression, blind rerun, mutable PR-head pin, sibling-scanner substitution, predecessor closure, or evidence transfer is authorized.