Repository navigation
project release: CVEs from packaging commits, follow aggregates; CHANGELOG-only release pushes skip populate - #198
Merged
Merged
Conversation
The release cut listed python3-dns as "Not scanned" although 6068c66 bumped it for CVE-2026-114605: staging carries it as an _aggregate of ppg:common:deps, so no _service (and no upstream url) was found, and the CVE named in our own commit was never looked at. - _find_pkg_service follows a local _aggregate to the source package's _service (scanner input and the Changed-line release-note link). - The CVE scan also reads this repo's commit messages since the previous release tag for the package's source dir, collecting CVE and GHSA ids the upstream line does not already list. - obs-release-pr: a push that changes only release CHANGELOG.md files keeps the populated pre-release (kind=changelog, populate/QA skipped). Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
0456f03 landed unformatted, so the Python Tests black check fails on every PR. Signed-off-by: Ricardo Dias <ricardo.dias@percona.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 17.11-3 / 18.6-3 cuts (#197) listed python3-dns as "Not scanned" although 6068c66 bumped it for CVE-2026-114605. Two gaps:
_aggregateofppg:common:deps, so_find_pkg_servicefound no_service: no upstream URL for the CVE scanner and no release-note link on the Changed line. It now follows a local_aggregateto the source package's_service(also for subproject keys).CVE-…/GHSA-…ids the upstream line does not already list:- python3-dns: 2.8.0→2.9.0 fixes CVE-2026-114605 (packaging commit 6068c662)Also,
obs-release-pr: a push to a release PR that changes only releaseCHANGELOG.mdfiles (hand-editing the notes) no longer repopulates.resolvecompares the push (event.before...head) and reportskind=changelog; populate and QA are skipped and the existing pre-release stands. Opening the PR, a dispatch, any other file in the push, or a failed compare still repopulates.Testing:
changelog_only; 748 passed, pyright 0 errors._build_changed_packages+scan_release_cvesfor python3-dns againstppg/18.6-2→ upstream resolved to rthalley/dnspython, line above produced.After merge: push the hand-edited CHANGELOG fix to #197 (should skip populate).