ci: add mend integration - #12520
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughAdded Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 7✅ Passed checks (7 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Frontend Unit Test Coverage ReportCoverage Summary
Unit Test Results
|
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (49.97%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #12520 +/- ##
==========================================
- Coverage 52.88% 52.63% -0.26%
==========================================
Files 2023 2023
Lines 183784 183070 -714
Branches 27387 27598 +211
==========================================
- Hits 97202 96359 -843
- Misses 85484 85612 +128
- Partials 1098 1099 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/mend.yml (2)
37-43: Static cache key makes Mend agent cache effectively stale/immutable.On Line 42,
actions/cacheuses a constant key. Cache entries are immutable, so refreshed agent binaries won’t be persisted under the same key, causing repeated re-download behavior after updates.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/mend.yml around lines 37 - 43, The cache step "Cache Mend Agent" (id: cache-mend) uses a static key "mend-agent-latest", which makes cached agent binaries immutable and prevents updates from being stored; change the cache key to be dynamic (for example include a checksum/hash of wss-unified-agent.jar, a version file, or a timestamp/commit hash) or add appropriate restore-keys so new agent binaries produce a new cache entry; update the "key" value to reference the computed/hash token (or include runner/os and commit) so updated jars are persisted and stale caches avoided.
56-56: Default CI scan log level should be less verbose.On Line 56,
-logLevel debugis very noisy and can increase exposure of scan metadata in logs. Preferinfoby default and enable debug only for incident triage.💡 Suggested change
- java -jar wss-unified-agent.jar -d src/frontend -logLevel debug + java -jar wss-unified-agent.jar -d src/frontend -logLevel info🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/mend.yml at line 56, The CI workflow uses the wss-unified-agent command with a very verbose flag "-logLevel debug" which floods logs; change the flag to "-logLevel info" in the job step that runs "java -jar wss-unified-agent.jar -d src/frontend -logLevel debug" so the default scan logging is less noisy, leaving debug only for explicit triage runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/mend.yml:
- Around line 44-46: Replace the fragile download and execution steps for the
Mend agent (the curl line "curl -L -z wss-unified-agent.jar -o
wss-unified-agent.jar" and the subsequent JAR execution step) with a hardened
sequence: run curl with --fail --show-error --retry (and keep -L -z -o) to
ensure non‑zero exit on HTTP errors and retries, save the downloaded file,
compute its SHA256 (e.g., via sha256sum or shasum) and compare against the
MEND_UA_SHA256 GitHub secret, and exit the job if the checksum does not match;
only after a verified checksum should the workflow run the JAR (the "java -jar
wss-unified-agent.jar" step), and that execution should also be run with strict
shell failure handling (set -e) so any non‑zero exit fails the job.
- Around line 6-7: The "Run Mend Scan" workflow step should be guarded so it
doesn't run for forked pull requests where repository secrets (e.g.,
MEND_API_KEY) are unavailable; update the step named "Run Mend Scan" to include
an if-condition that skips execution for pull_request events from forks or when
the required secret is missing (for example: only run when event is not
pull_request OR when pull_request.head.repo.fork == false and the secret
exists). Ensure the condition uses GitHub Actions context (github.event_name and
github.event.pull_request.head.repo.fork) and checks the secret presence
(secrets.MEND_API_KEY) so forked PRs won’t attempt the secret-dependent scan.
---
Nitpick comments:
In @.github/workflows/mend.yml:
- Around line 37-43: The cache step "Cache Mend Agent" (id: cache-mend) uses a
static key "mend-agent-latest", which makes cached agent binaries immutable and
prevents updates from being stored; change the cache key to be dynamic (for
example include a checksum/hash of wss-unified-agent.jar, a version file, or a
timestamp/commit hash) or add appropriate restore-keys so new agent binaries
produce a new cache entry; update the "key" value to reference the computed/hash
token (or include runner/os and commit) so updated jars are persisted and stale
caches avoided.
- Line 56: The CI workflow uses the wss-unified-agent command with a very
verbose flag "-logLevel debug" which floods logs; change the flag to "-logLevel
info" in the job step that runs "java -jar wss-unified-agent.jar -d src/frontend
-logLevel debug" so the default scan logging is less noisy, leaving debug only
for explicit triage runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3c696471-efe1-4685-8df5-5520bcfcdf02
📒 Files selected for processing (1)
.github/workflows/mend.yml
| pull_request: | ||
| branches: ["release-1.9.0", "main"] |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/mend.ymlRepository: langflow-ai/langflow
Length of output: 1978
🌐 Web query:
GitHub Actions fork pull request secrets unavailable behavior
💡 Result:
- Default behavior: Workflows triggered by a pull request from a fork (typically
on: pull_request) do not receive repository/org environment secrets. The job still getsGITHUB_TOKEN, but with minimal privileges (read-only). [1], [2], [3] - Why: Prevents a fork author from changing workflow/code and exfiltrating secrets during CI. [2], [3]
- Common “workaround” (use with care):
on: pull_request_targetruns the workflow from the base repo’s workflow file and can access secrets and a more-privilegedGITHUB_TOKEN, which is why it’s risky if you check out and run PR code (classic “pwn request”/secret-exfiltration pattern). [4], [5] - Dependabot behaves like a fork: Runs triggered by Dependabot for
pull_request/push-family events are treated like fork PRs (read-only token / no secrets by default). [6], [7]
Sources
[1] GitHub Docs – Understanding GitHub secret types (Actions secrets not passed to fork PR workflows) (docs.github.com)
[2] GitHub Blog – Four tips to keep your GitHub Actions workflows secure (fork PRs: no secrets, read-only token) (github.blog)
[3] GitHub Docs – Using secrets in GitHub Actions (secrets not passed on fork-triggered workflows) (docs.github.com)
[4] GitHub Docs – Security hardening for GitHub Actions (risk of pull_request_target exposing secrets) (docs.github.com)
[5] GitHub Security Lab – Preventing pwn requests (pull_request_target can expose token/secrets) (securitylab.github.com)
[6] GitHub Changelog – Dependabot-triggered workflows treated as forks (github.blog)
[7] GitHub Docs – Dependabot troubleshooting (Dependabot runs treated as fork PRs by default) (docs.github.com)
Citations:
- 1: https://docs.github.com/en/code-security/reference/secret-security/understanding-github-secret-types?utm_source=openai
- 2: https://github.blog/security/supply-chain-security/four-tips-to-keep-your-github-actions-workflows-secure/?utm_source=openai
- 3: https://docs.github.com/en/actions/how-tos/administering-github-actions/sharing-workflows-secrets-and-runners-with-your-organization?utm_source=openai
- 4: https://docs.github.com/en/enterprise-cloud%40latest/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions?learn=adopting_github_actions_for_your_enterprise_ghec&learnProduct=admin&utm_source=openai
- 5: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/?utm_source=openai
- 6: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/?utm_source=openai
- 7: https://docs.github.com/en/enterprise-server%403.15/code-security/how-tos/secure-your-supply-chain/troubleshoot-dependency-security/troubleshooting-dependabot-on-github-actions?utm_source=openai
Add conditional guard to prevent secret-dependent Mend scan from failing on forked PRs.
The "Run Mend Scan" step (lines 48–56) triggers on pull_request but depends on repository secrets that are unavailable in fork PR contexts. This causes predictable authentication failures and noisy logs for external contributors.
Suggested change
- name: Run Mend Scan
+ if: ${{ secrets.WS_APIKEY != '' && secrets.WS_USERKEY != '' && secrets.WS_WSS_URL != '' }}
env:
WS_APIKEY: ${{ secrets.WS_APIKEY }}
WS_WSS_URL: ${{ secrets.WS_WSS_URL }}
WS_USERKEY: ${{ secrets.WS_USERKEY }}
WS_PRODUCTNAME: ${{ secrets.WS_PRODUCTNAME }}
WS_PROJECTNAME: ${{ secrets.WS_PROJECTNAME }}
run: |
java -jar wss-unified-agent.jar -d src/frontend -logLevel debug🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/mend.yml around lines 6 - 7, The "Run Mend Scan" workflow
step should be guarded so it doesn't run for forked pull requests where
repository secrets (e.g., MEND_API_KEY) are unavailable; update the step named
"Run Mend Scan" to include an if-condition that skips execution for pull_request
events from forks or when the required secret is missing (for example: only run
when event is not pull_request OR when pull_request.head.repo.fork == false and
the secret exists). Ensure the condition uses GitHub Actions context
(github.event_name and github.event.pull_request.head.repo.fork) and checks the
secret presence (secrets.MEND_API_KEY) so forked PRs won’t attempt the
secret-dependent scan.
| - name: Download Mend Unified Agent if missing or outdated | ||
| run: | | ||
| curl -L -z wss-unified-agent.jar -o wss-unified-agent.jar https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/mend.ymlRepository: langflow-ai/langflow
Length of output: 1978
🏁 Script executed:
cd .github/workflows && ls -la | grep -i mendRepository: langflow-ai/langflow
Length of output: 122
🏁 Script executed:
# Check if MEND_UA_SHA256 secret is referenced anywhere in the repo
rg "MEND_UA_SHA256" --type yaml --type ymlRepository: langflow-ai/langflow
Length of output: 91
🏁 Script executed:
# Search for integrity verification patterns in workflows
rg "sha256sum|checksum|SHASUM" .github/workflows/ --type yamlRepository: langflow-ai/langflow
Length of output: 133
🏁 Script executed:
# Check if there are any other download patterns with verification
rg "curl.*sha" .github/workflows/ -A 2 -B 2Repository: langflow-ai/langflow
Length of output: 46
Implement integrity verification and add strict curl error handling for JAR download.
The workflow downloads and executes a remote JAR without integrity verification or strict error handling. On line 46, the curl command lacks failure flags and will not halt on transient errors. This creates a supply-chain risk if the downloaded artifact is compromised or corrupted.
Add --fail, --show-error, and --retry flags to the curl command and implement SHA256 verification:
Required hardening
- name: Download Mend Unified Agent if missing or outdated
run: |
- curl -L -z wss-unified-agent.jar -o wss-unified-agent.jar https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar
+ curl --fail --show-error --silent --location --retry 3 --retry-delay 2 \
+ -z wss-unified-agent.jar \
+ -o wss-unified-agent.jar \
+ https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar
+ echo "${{ secrets.MEND_UA_SHA256 }} wss-unified-agent.jar" | sha256sum -c -Also add the MEND_UA_SHA256 secret to your GitHub repository.
Also applies to line 56 (JAR execution).
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Download Mend Unified Agent if missing or outdated | |
| run: | | |
| curl -L -z wss-unified-agent.jar -o wss-unified-agent.jar https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar | |
| - name: Download Mend Unified Agent if missing or outdated | |
| run: | | |
| curl --fail --show-error --silent --location --retry 3 --retry-delay 2 \ | |
| -z wss-unified-agent.jar \ | |
| -o wss-unified-agent.jar \ | |
| https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar | |
| echo "${{ secrets.MEND_UA_SHA256 }} wss-unified-agent.jar" | sha256sum -c - |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/mend.yml around lines 44 - 46, Replace the fragile
download and execution steps for the Mend agent (the curl line "curl -L -z
wss-unified-agent.jar -o wss-unified-agent.jar" and the subsequent JAR execution
step) with a hardened sequence: run curl with --fail --show-error --retry (and
keep -L -z -o) to ensure non‑zero exit on HTTP errors and retries, save the
downloaded file, compute its SHA256 (e.g., via sha256sum or shasum) and compare
against the MEND_UA_SHA256 GitHub secret, and exit the job if the checksum does
not match; only after a verified checksum should the workflow run the JAR (the
"java -jar wss-unified-agent.jar" step), and that execution should also be run
with strict shell failure handling (set -e) so any non‑zero exit fails the job.
erichare
left a comment
erichare
left a comment
There was a problem hiding this comment.
Review: ci: add mend integration (#12520)
Overall a clean, minimal addition. A few issues worth addressing before merge:
🔴 Issues
- Missing newline at EOF (
.github/workflows/mend.yml:56) — file ends with\ No newline at end of file. Add a trailing newline. - Stale branch in triggers —
release-1.9.0is listed in bothpushandpull_requestbranches, but the current release line is 1.10.0 (per recent commits). Either bump torelease-1.10.0or drop the specific release branch and rely onmainonly. - Cache key is not content-addressed —
key: mend-agent-latestis a static key. The cache will never refresh, so the-z(if-modified-since) flag on curl will always see the cached jar and skip updates. Either:- Use a dated/versioned key (e.g.
mend-agent-${{ github.run_id }}with a weeklyrestore-keysprefix), or - Drop the cache entirely since the download is cheap and correctness matters more than saved seconds on a security scan.
- Use a dated/versioned key (e.g.
- Step name misleading — "Download Mend Unified Agent if missing or outdated" runs unconditionally and doesn't actually check age beyond
curl -z, which compares against the local file mtime restored from cache (always "fresh" from cache's POV). Combined with the static cache key above, the agent can get pinned indefinitely. Considerif: steps.cache-mend.outputs.cache-hit != 'true'or remove the cache.
🟡 Suggestions
- Pin action versions to SHAs — security workflows especially should pin
actions/checkout,actions/setup-node,actions/setup-java,actions/cacheto full SHAs rather than major tags, to prevent supply-chain drift. - Concurrency group — add
concurrency: { group: mend-${{ github.ref }}, cancel-in-progress: true }to avoid duplicate scans on rapid pushes. permissions:block missing — explicitly set least-privilege permissions (e.g.permissions: { contents: read }). Default token perms on security scans should be minimal.- PRs from forks will fail silently — secrets (
WS_APIKEY, etc.) aren't available to fork PRs. Thejava -jarstep will run with empty env vars and likely error or submit under a null project. Guard withif: github.event.pull_request.head.repo.full_name == github.repositoryor switch topull_request_targetcarefully (with its own risks). -logLevel debug— debug logs can be verbose and may leak dependency paths/names into public CI logs. Considerinfofor default PR runs.- Java 21 + Node 24 — confirm the frontend toolchain actually requires Node 24; current repo may be pinned lower. Worth aligning with existing CI.
🟢 Nits
.gitignoreadditions forwhitesource/look correct.- Job name
run-jaris generic —mend-scanwould be clearer.
✅ Approval
Approve-with-changes. The caching/trigger-branch/fork-secret issues are the only ones I'd block on; the rest are quality-of-life.
add mend integration to OSS
add whitesource to .gitignore and scan all of src
address eric's comment 1
057e6c2 to
cafcca4
Compare
|
@erichare I addressed as many as I think make sense or are possible. For the ones unaddressed I have comments below
We don't do this anywhere else in our yml files and it would add a lot of maintence to our code base. I think it is fine if we want to go this route but it would become a regular mantaince issue any time there is an update
I made it a larger wild card. We still want mend running on patch branches and maintaining that list strictly would be very difficult. Code rabbit:
mend doesn't offer this. it is literally just a link https://pages.github.ibm.com/Supply-Chain-Security/Mend/docs/Getting%20Started/Unified%20Agent%20Scan/ |
2 participants
add mend integration to OSS
Summary by CodeRabbit