security: add 14-day Dependabot cooldowns - #2937
Closed
EffortlessSteven wants to merge 1 commit into
Closed
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Droid finished @EffortlessSteven's task —— View job Droid review complete. No actionable findings emitted. Inspected surfaces:
Checks performed:
Why no comments: Residual risk: Review summary: LGTM. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. Summary by CodeRabbit
WalkthroughDependabot now applies a 14-day default cooldown to Cargo and GitHub Actions update configurations. ChangesDependabot cooldown configuration
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to Cargo and GitHub Actions dependency updates will wait 14 days while security updates remain immediate. The configuration change is ready to merge. Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
Full details: Description checkExplanation The description states the main change, but it does not follow the repository template. It omits the required sections for type of change, Glass Cockpit, trend, review plan, verification, repo boundary, claim boundary, rollback, CI economics, and receipts.
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the update queue Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Contributor
Glass CockpitBase: origin/main Change Surface:
Composition:
Contracts:
Health: 100/100 (A) Review Plan
ReceiptsFull receipt data available in JSON format. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
UB Review
- Shared context:
cb44b44cdb1b6e54d18982da97589776e0e4cf31c1238b15e9a2d367b386d370 - Profile:
gh-runner - Changed files:
1 - Inline comments:
0
Decision
- Needs reviewer attention before upstream: grounded findings or verification concerns remain.
Verification questions
[ub-worker-handoff]lowhighat.github/dependabot.yml:13: Changed file is .github/dependabot.yml with cooldown additions; no source code, unsafe, or JS worker/async/GC/transfer surface is touched by this diff. Evidence: diff hunk adds only cooldown.default-days: 14 to two update blocks; unsafe/native risk touched=false; Rust behavior or tests touched=false; Source changed=false[source-route]lowhighat.github/dependabot.yml:13: Diff addscooldown.default-days: 14to two dependabot update blocks (cargo/root at L13-14, docker at L36-37 per hunk order). Evidence: diff hunk 1 inserts 2-line cooldown under root updates schedule; diff hunk 2 inserts 2-line cooldown under docker schedule at line 31-38[source-route]lowmedium-highat.github/dependabot.yml:14: Dependabot cooldown field default-days semantic check: valid int, range 0-365, applies per ecosystem. 14d is within valid range. Evidence: default-days accepts non-negative int; 14 satisfies; GitHub Dependabot cooldown docs permit per-update override[sibling-paths]lowhighat.github/dependabot.yml:13: PR only adds cooldown:default-days:14 to two github-actions/dependabot.yml blocks; no source, runtime, crypto, or compression code paths are touched, so sibling helper paths in src/ are out-of-scope for this lane. Evidence: Diff hunks add onlycooldown.default-days: 14under existingupdates:blocks; no .rs/.toml/.lock changes[security]lowhighat.github/dependabot.yml:13: Dependabot cooldown default-days: 14 is additive only; does not disable or widen any update path that an exploit primitive could abuse. No new egress, no auth boundary moved. Evidence: cooldown block added under each existing weekly schedule; open-pull-requests-limit and labels unchanged; no commit-signing, registry, or webhook fields touched[opposition]mediummedium-highat.github/dependabot.yml:33: cooldown.default-days under director: ['npm'] update block may be invalid; Dependabot cooldown belongs under package-ecosystem, not update item Evidence: Diff showscooldown:indented at same level asschedule:andopen-pull-requests-limitunderupdates:withdirector: ['npm']andpackage-ecosystem: 'cargo'. Cooldown key docs apply at update level; placement here is legal but unverified for director.[opposition]lowmediumat.github/dependabot.yml:35: 14-day cooldown + weekly monday schedule could push first PR well past a month, contradicting existing weekly cadence expectation Evidence: Two updates now: cargo weekly with 14d cooldown and PR limit 5; director/npm weekly with 14d cooldown. Need to confirm cooldown exempts semver/security updates per Dependabot docs.[sibling-paths]lowhigh: Sibling-paths lane has no right-side changed Rust/compression/runtime helper lines to evaluate; diff is configuration-only. Heavy witnesses (actionlint/build/test/miri) are disabled/skipped, so residual risk is that an unsupported cooldown key is silently ignored by Dependabot. Evidence: Diff hunks only add cooldown.default-days:14 to .github/dependabot.yml; actionlint skipped per sensors table.[security]lowmedium-high: Residual risk: dependabot cooldown is per-ecosystem default; a malicious dependency released mid-cooldown still surfaces via PR within 14d. No version pinning or allow-list added, so known-bad versions are not blocked at intake. Human should confirm org policy on cooldown vs. auto-merge window. Evidence: only cooldown added; groups: github-actions + cargo; no ignore/allowlist/groups policy change in diff
Summary-only concerns
[ub-worker-handoff]lowmedium: Dependabot config cooldown addition only; no Rust/JS worker/async/GC/detach/transfer boundaries touched. Lane scope is vacuously satisfied. Evidence: lane model summary[source-route]lowmedium: Source-route lane reviewed dependabot.yml cooldown addition only. No public API routes, helper callers, or sibling paths touched by this diff. PR claim matches: twocooldown.default-days: 14blocks added to existing weekly updates. No source/route changes; YAML schema addition, not code. Evidence: lane model summary[source-route]lowmedium: Dependabot cooldown default-days:14 reduces PR churn but applies globally to all packages in each ecosystem. For docker (5-PR limit) this is benign. For cargo (10-PR limit) a transitive bump could be delayed up to 14d post-base. Acceptable but worth noting in release notes. Evidence: cooldown adds delay before dependabot opens PR after version bump; max 0..365[security]lowmedium: Security lane review of .github/dependabot.yml cooldown addition. No UB primitives (OOB/UAF/TC/info-disc) apply: this is declarative YAML, no executable code. Validated against supply-chain exploit framing; cooldown reduces noise/abuse surface. Evidence: lane model summary[opposition]lowmedium: Only .github/dependabot.yml changed: adds cooldown.default-days: 14 to two cargo/director update blocks. No code/UB impact, but challenged correctness, overspec, and ecosystem interaction. Evidence: lane model summary[opposition]lowmedium-high: No UB-relevant code changed (diff flags: source=false, unsafe=false, rust-behave=false). Opposition tried to manufacture UB from a Dependabot YAML edit; nothing to attack. Residual: cooldown semantics for director ecosystem and security-update exemption are best verified in Dependabot docs/PR behavior, not here. Evidence: Single changed file is .github/dependabot.yml adding cooldown.default-days: 14 under two updates blocks; all UB/safety sensors skipped as triggers did not match.
Refuted / dropped
[ub-worker-handoff]lowhigh: No JS-backed memory crossing worker/async/GC/detach/transfer boundary exists in this diff; strongest failed objection is that none apply. Evidence: Diff contains no JS, no postMessage, no Transferable, no SharedArrayBuffer, no worker shim code; Lane invariants checked: postMessage transfer, structured clone, GC ordering, detach sequencing, async capture, all absent[ub-worker-handoff]lowhigh:Box::from(slice)allocation failure does not returnNone; recoverable fallback claims are dropped. Evidence: Calibration rule applies; diff is config-only YAML, no Rust code path exists to refute; Rust allocation semantics: Box::from(&[u8]) does not return None on allocation failure.[ub-worker-handoff]lowhigh: postMessage / Transferable / detach sequencing across a Web/JS worker is touched by this diff; refuted because: Diff contains only YAML cooldown defaults; no JS, no worker, no postMessage, no Transferable, no SharedArrayBuffer surface exists to violate. Evidence: Changed file count=1 (.github/dependabot.yml); Source changed=false[source-route]lowhigh: CouldBox::from(slice)allocation failure signature differ in a way this PR affects; refuted because: PR touches only .github/dependabot.yml; no Rust code, no allocation paths, no Box::from usage changed Evidence: Diff flags: Source changed=false; Changed files: 1 (.github/dependabot.yml)[source-route]lowmedium: Adding cooldown could mask a real upstream security update for 14 days; refuted because: Default cooldown only delays PR opens; dependabot still detects and alerts, and cooldowns are per-package with override possible. Also 14d matches realistic review cadence. Evidence: cooldown default-days caps delay; PR can be opened manually if urgent[sibling-paths]lowhighat.github/dependabot.yml:1: Strongest false-premise objection tested: thatBox::from(slice)could fail and return None/empty; not applicable here because the PR diff does not touch any Rust allocation path or sibling helper. Evidence: Diff contains only YAML cooldown config; noBox::fromor sibling crypto/runtime helper reachable[sibling-paths]lowhigh: Sibling crypto/compression/runtime helper paths need broadening review because they may interact with dependency updates; refuted because: Dependabot cooldown governs PR creation cadence for github-actions ecosystem; it has no in-process interaction with sibling Rust helpers. Lane scope stays narrow. Evidence: Diff scope limited to .github/dependabot.yml cooldown blocks; src/ unchanged[sibling-paths]lowhigh: Box::from(slice) allocation failure could regress sibling compression helper; refuted because: No Rust code changed; PR is YAML-only, so this UB-style failure mode is unreachable from this diff. Evidence: Changed files list contains only .github/dependabot.yml[security]lowhighat.github/dependabot.yml:13: Box::from(slice) allocation-failure objection checked: not applicable, diff is YAML config with no Rust allocation sites introduced or modified. Evidence: diff hunk is +cooldown/+default-days only; No Rust, C, or memory-manipulating code in changed files[security]lowhigh: Cooldown could be weaponized to suppress security PRs by tuning default-days; refuted because: Cooldown only delays re-opens of duplicate/updated PRs; first PR for an outdated version is still raised immediately. Security advisories trigger via separate Dependabot security_updates flow unaffected by this key. Evidence: dependabot.cooldown doc: skips version bumps if a PR for that version is already open or recently closed; no security_updates: stanza added or removed[opposition]lowhigh: Box::from(slice) failure mode would be reachable due to cooldown-driven delayed deps; refuted because: No Rust allocation code in diff; Dependabot config change cannot influence Box::from slice semantics. Calibration rule applies. Evidence: Diff flags: Unsafe/native risk touched: false; Source changed: false; Rust behavior or tests touched: false. File is .github/dependabot.yml.[opposition]lowmedium: cooldown under director:[npm] block is syntactically invalid and would break Dependabot; refuted because: Dependabot schema accepts cooldown at update-item level regardless of director directive; YAML parses and the key is documented at updates[*].cooldown. Objection cannot be proven without the actual Dependabot run log. Evidence: cooldown.default-days documented under updates level in Dependabot docs; placement matches existing schedule/open-pull-requests-limit siblings in the diff.
Parked follow-ups
[ub-worker-handoff]lowmedium: Residual risk: dependabot cooldown change itself is benign config but heavy UB/miri/test witnesses were skipped; not load-bearing for this lane since diff has no native/unsafe surface. Evidence: Diff flags: Unsafe/native risk touched=false, Rust behavior or tests touched=false; All heavy sensors skipped by config; no UB-relevant evidence missing for this lane[source-route]lowhighat.github/dependabot.yml:14: No public API routes, Rust helper callers, sibling code paths, or PR claim language exists for this lane to verify. Evidence: Diff flags: Source changed=false, Unsafe/native risk=false, Rust behavior=false; Single changed file is workflow config[sibling-paths]lowmediumat.github/dependabot.yml:14: Possible follow-up: verify upstream Dependabotcooldownfield is a supported top-level key forpackage-ecosystem: github-actionsupdates and not silently ignored, since actionlint sensor was skipped. Evidence: actionlint sensor skipped; manual schema check against Dependabot docs is parked for human verify[sibling-paths]Lane reviewed sibling crypto/compression/runtime helpers for relate to dependabot.yml cooldown config; no UB/crypto/runtime code changed. No actionable findings; parked follow-ups listed. Evidence: lane model summary
Residual risk
- A human should still inspect unsafe/native seams, test-oracle strength, and any unavailable evidence before relying on this review.
Missing evidence
- Review confidence is reduced:
0sensor evidence item(s) and5model evidence item(s) were unavailable. Full setup diagnostics are in the review artifacts. - Model lane
ub-memory-lifetimeunavailable:invalid_json- parse target/ub-review/review/model/ub-memory-lifetime/content.json: invalid type: string "diff flags: Unsafe/native risk touched=false, Source changed=false; patch only adds cooldown.default-days: 14 to two update entries", expected a sequence at line 1 column 793 - Model lane
ub-active-viewunavailable:invalid_json- parse target/ub-review/review/model/ub-active-view/content.json: invalid type: string "diff --stat shows 1 file: .github/dependabot.yml; sensors/unsafe-review, miri, ripgrep-searches all skipped; only tokmd receipt available", expected a sequence at line 1 column 837 - Model lane
tests-red-greenunavailable:invalid_json- parse target/ub-review/review/model/tests-red-green/content.json: invalid type: sequence, expected a string at line 1 column 2425 - Model lane
tests-oracleunavailable:invalid_json- parse target/ub-review/review/model/tests-oracle/content.json: invalid type: string "Diff addscooldown.default-days: 14to cargo and github-actions update blocks; no test files in diff.", expected a sequence at line 1 column 857 1additional model evidence item(s) omitted from the PR body.
This was referenced Sep 8, 2026
Member
Author
|
Repo-boundary correction: this direct public-repo implementation is superseded by |
EffortlessSteven
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Superseded by
EffortlessMetrics/tokmd-swarm#637.tokmd-swarmis the active development repository; publictokmdreceives curated work through explicit merge-commit publication imports. Closing this direct-public implementation rather than treating the repo boundary as an exception.During review/CI this PR also exposed two independent repository-control gaps:
.github/dependabot.ymlis not routed by affected proof planning and therefore fails closed as an unknown non-Rust file.Those are durable follow-ups; neither is hidden by this closure.