danablend opened a new pull request, #41535: URL: https://github.com/apache/superset/pull/41535
… CVEs Add a security-scanning workflow that audits Superset's real pinned dependency lockfiles for real published vulnerabilities and files one idempotent GitHub issue per actionable finding for a downstream remediation orchestrator to consume. - scripts/scan_and_file_issues.py: runs pip-audit (--no-deps, JSON) against the repo's real requirements lockfiles (default requirements/base.txt), triages findings into a `devin-remediate` queue (concrete fix available) vs `no-fix-available`, enriches severity via the OSV API for sorting and an env-driven severity filter and volume cap (default 25), and creates idempotent issues keyed on a stable title with a machine-readable JSON payload. Stdlib + requests; reads GITHUB_TOKEN/GITHUB_REPOSITORY from env. - .github/workflows/security-scan.yml: daily cron + workflow_dispatch + push on manifest changes; contents:read/issues:write; Python 3.11. - docs/DEVIN_DEMO.md: documents the real-deps scanning, triage rules, and orchestrator handoff. No existing requirements, lockfiles, or source are modified; nothing is synthetic. <!--- Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/ Example: fix(dashboard): load charts correctly --> ### SUMMARY <!--- Describe the change below, including rationale and design decisions --> ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF <!--- Skip this if not applicable --> ### TESTING INSTRUCTIONS <!--- Required! What steps can be taken to manually verify the changes? --> ### ADDITIONAL INFORMATION <!--- Check any relevant boxes with "x" --> <!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue --> - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
