mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-06 08:40:44 +00:00
6de9d71bfb
* feat(security): add GHSA detector-review pipeline and OpenGrep CI workflows [AI-assisted]
Stand up an end-to-end pipeline that turns every published openclaw GitHub
Security Advisory into a reusable OpenGrep rule, and wire the compiled rules
into manual-dispatch GitHub Actions workflows that publish SARIF to GitHub
Code Scanning.
The pipeline is harness-agnostic: any coding-agent CLI (Rovo Dev, Claude
Code, Codex, OpenCode, or anything you can shell out to) can drive it via
the runner script's --harness flag. Built-in adapters cover the four common
harnesses; --harness-cmd '<template>' supports anything else with shell-style
{prompt}/{model}/{output_file} substitution.
Pipeline pieces:
- scripts/run-ghsa-detector-review-batch.mjs runs your chosen coding harness
in parallel against every advisory using the agent-agnostic detector-review
spec at security/detector-review/detector-review-spec.md. Each case
produces an opengrep general-rule.yml (precise) and broad-rule.yml
(review-aid), plus a coverage-validated report against the vulnerable
commit's changed files.
- scripts/compile-opengrep-rules.mjs walks a run directory, rewrites each
rule's id to ghsa-detector.<ghsa>.<orig-id>, injects ghsa/advisory-url/
detector-bucket/source-rule-id metadata, and uses opengrep itself to drop
rules with InvalidRuleSchemaError so the published super-configs load
cleanly.
Compiled outputs:
- security/opengrep/precise.yml (336 rules)
- security/opengrep/broad.yml (459 rules)
- security/opengrep/compile-manifest.json (per-rule provenance map)
CI workflows (manual workflow_dispatch only):
- .github/workflows/opengrep-precise.yml
- .github/workflows/opengrep-broad.yml
Both install a pinned opengrep, run opengrep scan against src/, upload SARIF
to Code Scanning under categories opengrep-precise / opengrep-broad, and use
continue-on-error: true so findings never block the workflow.
Detector-review spec and assets:
- security/detector-review/detector-review-spec.md the agent-agnostic spec
the runner injects into each per-case prompt
- security/detector-review/references/{detector-rubric,report-template}.md
- security/detector-review/scripts/init_case.py
- security/prompt-suffix-coverage-first.md mandatory prompt addendum that
enforces coverage-first validation (rule must catch the OG vuln, not just
pass synthetic fixtures)
Docs:
- security/README.md end-to-end flow, supported harnesses, regen recipe
- security/opengrep/README.md compiled-config details + recompile recipe
* security: tighten GHSA OpenGrep detector workflow
* chore: refine precise opengrep workflow
* chore: remove stale opengrep metadata
* fix: harden GHSA OpenGrep workflow
* ci: split OpenGrep diff and full scans
* chore: remove performance-only opengrep rule
* ci: use OpenGrep installer path
* chore: enforce opengrep rule metadata provenance
* chore: generalize opengrep rule compilation
* docs: align opengrep rulepack guidance
* chore: support generic opengrep rule sources
* fix: validate opengrep rulepack-only changes
---------
Co-authored-by: Jesse Merhi <security-engineering@atlassian.com>
197 lines
4.4 KiB
Plaintext
197 lines
4.4 KiB
Plaintext
node_modules
|
|
**/node_modules/
|
|
.env
|
|
docker-compose.override.yml
|
|
docker-compose.extra.yml
|
|
docker-compose.sandbox.yml
|
|
dist
|
|
dist-runtime/
|
|
pnpm-lock.yaml
|
|
bun.lock
|
|
bun.lockb
|
|
coverage
|
|
__openclaw_vitest__/
|
|
__pycache__/
|
|
*.pyc
|
|
.tsbuildinfo
|
|
.pnpm-store
|
|
.worktrees/
|
|
.DS_Store
|
|
**/.DS_Store
|
|
ui/src/ui/__screenshots__/
|
|
ui/playwright-report/
|
|
ui/test-results/
|
|
packages/dashboard-next/.next/
|
|
packages/dashboard-next/out/
|
|
|
|
# Mise configuration files
|
|
mise.toml
|
|
|
|
# Android build artifacts
|
|
apps/android/.gradle/
|
|
apps/android/app/build/
|
|
apps/android/.cxx/
|
|
apps/android/.kotlin/
|
|
apps/android/benchmark/results/
|
|
|
|
# Bun build artifacts
|
|
*.bun-build
|
|
apps/macos/.build/
|
|
apps/macos-mlx-tts/.build/
|
|
apps/shared/MoltbotKit/.build/
|
|
apps/shared/OpenClawKit/.build/
|
|
apps/shared/OpenClawKit/Package.resolved
|
|
**/ModuleCache/
|
|
bin/
|
|
bin/clawdbot-mac
|
|
bin/docs-list
|
|
apps/macos/.build-local/
|
|
apps/macos/.swiftpm/
|
|
apps/shared/MoltbotKit/.swiftpm/
|
|
apps/shared/OpenClawKit/.swiftpm/
|
|
Core/
|
|
apps/ios/*.xcodeproj/
|
|
apps/ios/*.xcworkspace/
|
|
apps/ios/.swiftpm/
|
|
apps/ios/.derivedData/
|
|
apps/ios/.local-signing.xcconfig
|
|
vendor/
|
|
apps/ios/Clawdbot.xcodeproj/
|
|
apps/ios/Clawdbot.xcodeproj/**
|
|
apps/macos/.build/**
|
|
apps/macos-mlx-tts/.build/**
|
|
**/*.bun-build
|
|
apps/ios/*.xcfilelist
|
|
|
|
# Vendor build artifacts
|
|
vendor/a2ui/renderers/lit/dist/
|
|
src/canvas-host/a2ui/*.bundle.js
|
|
src/canvas-host/a2ui/*.map
|
|
.bundle.hash
|
|
|
|
# fastlane (iOS)
|
|
apps/ios/fastlane/README.md
|
|
apps/ios/fastlane/report.xml
|
|
apps/ios/fastlane/Preview.html
|
|
apps/ios/fastlane/screenshots/
|
|
apps/ios/fastlane/test_output/
|
|
apps/ios/fastlane/logs/
|
|
apps/ios/fastlane/.env
|
|
|
|
# fastlane build artifacts (local)
|
|
apps/ios/*.ipa
|
|
apps/ios/*.dSYM.zip
|
|
|
|
# provisioning profiles (local)
|
|
apps/ios/*.mobileprovision
|
|
|
|
# Local untracked files
|
|
.local/
|
|
docs/.local/
|
|
docs/internal/
|
|
tmp/
|
|
IDENTITY.md
|
|
USER.md
|
|
.tgz
|
|
.idea
|
|
|
|
# local tooling
|
|
.serena/
|
|
|
|
# Local project-agent skill installs. Only repo-owned skills are visible by
|
|
# default; promoting a new repo skill should require an intentional `git add -f`.
|
|
.agents/skills/*
|
|
!.agents/skills/blacksmith-testbox/
|
|
!.agents/skills/blacksmith-testbox/**
|
|
!.agents/skills/gitcrawl/
|
|
!.agents/skills/gitcrawl/**
|
|
!.agents/skills/openclaw-ghsa-maintainer/
|
|
!.agents/skills/openclaw-ghsa-maintainer/**
|
|
!.agents/skills/openclaw-parallels-smoke/
|
|
!.agents/skills/openclaw-parallels-smoke/**
|
|
!.agents/skills/openclaw-pr-maintainer/
|
|
!.agents/skills/openclaw-pr-maintainer/**
|
|
!.agents/skills/openclaw-qa-testing/
|
|
!.agents/skills/openclaw-qa-testing/**
|
|
!.agents/skills/openclaw-release-maintainer/
|
|
!.agents/skills/openclaw-release-maintainer/**
|
|
!.agents/skills/openclaw-secret-scanning-maintainer/
|
|
!.agents/skills/openclaw-secret-scanning-maintainer/**
|
|
!.agents/skills/openclaw-test-heap-leaks/
|
|
!.agents/skills/openclaw-test-heap-leaks/**
|
|
!.agents/skills/openclaw-test-performance/
|
|
!.agents/skills/openclaw-test-performance/**
|
|
!.agents/skills/openclaw-testing/
|
|
!.agents/skills/openclaw-testing/**
|
|
!.agents/skills/optimizetests/
|
|
!.agents/skills/optimizetests/**
|
|
!.agents/skills/parallels-discord-roundtrip/
|
|
!.agents/skills/parallels-discord-roundtrip/**
|
|
!.agents/skills/security-triage/
|
|
!.agents/skills/security-triage/**
|
|
!.agents/skills/tag-duplicate-prs-issues/
|
|
!.agents/skills/tag-duplicate-prs-issues/**
|
|
|
|
# Agent credentials and memory (NEVER COMMIT)
|
|
/memory/
|
|
.agent/*.json
|
|
!.agent/workflows/
|
|
/local/
|
|
package-lock.json
|
|
.claude/
|
|
.agent/
|
|
skills-lock.json
|
|
|
|
# Local iOS signing overrides
|
|
apps/ios/LocalSigning.xcconfig
|
|
|
|
# Xcode build directories (xcodebuild output)
|
|
apps/ios/build/
|
|
apps/shared/OpenClawKit/build/
|
|
Swabble/build/
|
|
|
|
# Generated protocol schema (produced via pnpm protocol:gen)
|
|
dist/protocol.schema.json
|
|
.ant-colony/
|
|
|
|
# Eclipse
|
|
**/.project
|
|
**/.classpath
|
|
**/.settings/
|
|
**/.gradle/
|
|
|
|
# Synthing
|
|
**/.stfolder/
|
|
.dev-state
|
|
docs/superpowers
|
|
.superpowers/
|
|
.gitignore
|
|
test/config-form.analyze.telegram.test.ts
|
|
ui/src/ui/theme-variants.browser.test.ts
|
|
ui/src/ui/__screenshots__
|
|
ui/src/ui/views/__screenshots__
|
|
ui/.vitest-attachments
|
|
|
|
# Generated docs baseline artifacts (locally generated, only hashes tracked)
|
|
docs/.generated/*.json
|
|
docs/.generated/*.jsonl
|
|
|
|
# Deprecated changelog fragment workflow
|
|
changelog/fragments/
|
|
|
|
# Local scratch workspace
|
|
.tmp/
|
|
.vmux*
|
|
.artifacts/
|
|
test/fixtures/openclaw-vitest-unit-report.json
|
|
analysis/
|
|
.artifacts/qa-e2e/
|
|
extensions/qa-lab/web/dist/
|
|
|
|
# Generated bundled plugin runtime dependency manifests
|
|
extensions/**/.openclaw-runtime-deps.json
|
|
extensions/**/.openclaw-runtime-deps-stamp.json
|
|
|
|
# Output dir for scripts/run-opengrep.sh (local opengrep scans)
|
|
/.opengrep-out/
|