feat(detector/vuls2): adopt forward-compatible enum serde and surface evaluation warnings#2609
Draft
shino wants to merge 7 commits into
Draft
feat(detector/vuls2): adopt forward-compatible enum serde and surface evaluation warnings#2609shino wants to merge 7 commits into
shino wants to merge 7 commits into
Conversation
…num serde vuls-data-update is pinned to the nightly containing MaineK00n/vuls-data-update#887 (string enums with lenient serde and the FilteredCriterion.Warnings machinery). vuls2 is TENTATIVELY pinned to the head of MaineK00n/vuls2#412 (the consumer-side adaptation); re-pin to the nightly commit once that PR merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Data a vuls binary cannot evaluate (e.g. enum values produced by a newer vuls-data-update) is skipped during vuls2 detection with a warning recorded on the FilteredCriteria trees. Aggregate them via vuls2/pkg/detect.CollectWarnings before any affected gating prunes the not-affected conditions carrying them, and project them into ScanResult.Warnings (deduplicated across the pkgs / cpe passes) so a silent skip is distinguishable from a genuine not-affected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Fail when the vuls-data-update pinned in go.mod knows fewer enum values than its nightly branch — a dependency bump is due before data produced with the new values reaches detection. The known sets are append-only, so a plain diff of tools/print-enums output suffices. Runs on every PR and on a daily schedule. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The check tests a repository-wide condition — whether the pinned vuls-data-update lags nightly — not anything a PR author controls. Per-PR runs would fail unrelated work (including dependabot bumps of other modules) whenever upstream drifts, and would permanently block hotfix PRs on maintenance lines whose pins are legitimately old. The daily cron is the drift alarm; workflow_dispatch covers on-demand checks while preparing a bump PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Drift is a state, not an event — it persists until a bump PR merges — so the alarm is one open issue (deduplicated by the enum-drift label, assigned to the vuls2-integration maintainers, carrying the enum diff and the run link) instead of a notification that depends on whoever last edited the cron. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
vuls2's DetectResult.Warnings is now map[SourceID]map[Kind][]cause; render one scan-result warning line per (source, kind) with the causes listed, iterating in sorted order for deterministic output. Empty-string causes (unset datum, or the constant collected by cause-less kinds like empty-range) stay in the data but are not rendered. The vuls2 pin moves to the head of MaineK00n/vuls2#412 accordingly (still tentative until that PR merges). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The diff job runs go run on code fetched from the upstream nightly branch; keeping issues: write on that same job would hand a compromised upstream the ability to write issues here. Split the issue filing into its own job (no checkout, no upstream code, issues: write only) fed via job outputs, and resolve the moving branch to a commit once per run so execution, the log, and the filed issue all refer to the same revision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adopt the forward-compatible enum serde line from vuls-data-update / vuls2, and surface vuls2's evaluation warnings in scan results:
chore(deps): bumpvuls-data-updateto the nightly containing feat!(extract/types): convert enum types to string MaineK00n/vuls-data-update#887 (string enums, lenient serde,FilteredCriterion.Warnings), andvuls2to the head of feat(detect): adopt forward-compatible enum serde from vuls-data-update MaineK00n/vuls2#412.feat(detector/vuls2): data this binary cannot evaluate (e.g. enum values produced by a newer vuls-data-update) is skipped during detection with a warning recorded on theFilteredCriteriatrees.detect()aggregates them viavuls2/pkg/detect.CollectWarnings(groupedmap[SourceID]map[Kind][]cause) — before any affected gating prunes the not-affected conditions carrying them — anddetectWith()projects one warning line per (source, kind) with its causes intoScanResult.Warnings(sorted iteration for determinism, deduplicated across the pkgs / cpe passes), so a silent skip is distinguishable from a genuine not-affected.ci: acheck-enumsworkflow (daily cron + workflow_dispatch — deliberately not per-PR: it checks a repository-wide condition no PR author controls, and per-PR runs would fail unrelated/dependabot PRs on upstream drift and block maintenance-line hotfixes) diffs the enum known sets of the go.mod-pinned vuls-data-update against itsnightlybranch viatools/print-enums. Any diff means a dependency bump is due before data produced with the new values reaches detection. A scheduled failure files one deduplicatedenum-driftissue assigned to the maintainers, carrying the enum diff and the run link.Why draft
The
vuls2pin is tentative: it points at the head of MaineK00n/vuls2#412 (dbdb3cd). Once that PR merges to vuls2 nightly, re-pin go.mod / go.sum to the merged commit and mark this ready.Testing
GOEXPERIMENT=jsonv2 go test ./...green against the pinned modules.🤖 Generated with Claude Code